@better-auth/sso 1.4.0-beta.1 → 1.4.0-beta.3

package/dist/index.cjs

@@ -91,64 +91,57 @@ const sso = (options) => {
         {
           method: "POST",
           body: z__namespace.object({
-            providerId: z__namespace.string({}).meta({
-              description: "The ID of the provider. This is used to identify the provider during login and callback"
-            }),
-            issuer: z__namespace.string({}).meta({
-              description: "The issuer of the provider"
-            }),
-            domain: z__namespace.string({}).meta({
-              description: "The domain of the provider. This is used for email matching"
-            }),
+            providerId: z__namespace.string({}).describe(
+              "The ID of the provider. This is used to identify the provider during login and callback"
+            ),
+            issuer: z__namespace.string({}).describe("The issuer of the provider"),
+            domain: z__namespace.string({}).describe(
+              "The domain of the provider. This is used for email matching"
+            ),
             oidcConfig: z__namespace.object({
-              clientId: z__namespace.string({}).meta({
-                description: "The client ID"
-              }),
-              clientSecret: z__namespace.string({}).meta({
-                description: "The client secret"
-              }),
-              authorizationEndpoint: z__namespace.string({}).meta({
-                description: "The authorization endpoint"
-              }).optional(),
-              tokenEndpoint: z__namespace.string({}).meta({
-                description: "The token endpoint"
-              }).optional(),
-              userInfoEndpoint: z__namespace.string({}).meta({
-                description: "The user info endpoint"
-              }).optional(),
+              clientId: z__namespace.string({}).describe("The client ID"),
+              clientSecret: z__namespace.string({}).describe("The client secret"),
+              authorizationEndpoint: z__namespace.string({}).describe("The authorization endpoint").optional(),
+              tokenEndpoint: z__namespace.string({}).describe("The token endpoint").optional(),
+              userInfoEndpoint: z__namespace.string({}).describe("The user info endpoint").optional(),
               tokenEndpointAuthentication: z__namespace.enum(["client_secret_post", "client_secret_basic"]).optional(),
-              jwksEndpoint: z__namespace.string({}).meta({
-                description: "The JWKS endpoint"
-              }).optional(),
+              jwksEndpoint: z__namespace.string({}).describe("The JWKS endpoint").optional(),
               discoveryEndpoint: z__namespace.string().optional(),
-              scopes: z__namespace.array(z__namespace.string(), {}).meta({
-                description: "The scopes to request. Defaults to ['openid', 'email', 'profile', 'offline_access']"
-              }).optional(),
-              pkce: z__namespace.boolean({}).meta({
-                description: "Whether to use PKCE for the authorization flow"
-              }).default(true).optional()
+              scopes: z__namespace.array(z__namespace.string(), {}).describe("The scopes to request. ").optional(),
+              pkce: z__namespace.boolean({}).describe("Whether to use PKCE for the authorization flow").default(true).optional(),
+              mapping: z__namespace.object({
+                id: z__namespace.string({}).describe("Field mapping for user ID ("),
+                email: z__namespace.string({}).describe("Field mapping for email ("),
+                emailVerified: z__namespace.string({}).describe("Field mapping for email verification (").optional(),
+                name: z__namespace.string({}).describe("Field mapping for name ("),
+                image: z__namespace.string({}).describe("Field mapping for image (").optional(),
+                extraFields: z__namespace.record(z__namespace.string(), z__namespace.any()).optional()
+              }).optional()
             }).optional(),
             samlConfig: z__namespace.object({
-              entryPoint: z__namespace.string({}).meta({
-                description: "The entry point of the provider"
-              }),
-              cert: z__namespace.string({}).meta({
-                description: "The certificate of the provider"
-              }),
-              callbackUrl: z__namespace.string({}).meta({
-                description: "The callback URL of the provider"
-              }),
+              entryPoint: z__namespace.string({}).describe("The entry point of the provider"),
+              cert: z__namespace.string({}).describe("The certificate of the provider"),
+              callbackUrl: z__namespace.string({}).describe("The callback URL of the provider"),
               audience: z__namespace.string().optional(),
               idpMetadata: z__namespace.object({
-                metadata: z__namespace.string(),
+                metadata: z__namespace.string().optional(),
+                entityID: z__namespace.string().optional(),
+                cert: z__namespace.string().optional(),
                 privateKey: z__namespace.string().optional(),
                 privateKeyPass: z__namespace.string().optional(),
                 isAssertionEncrypted: z__namespace.boolean().optional(),
                 encPrivateKey: z__namespace.string().optional(),
-                encPrivateKeyPass: z__namespace.string().optional()
+                encPrivateKeyPass: z__namespace.string().optional(),
+                singleSignOnService: z__namespace.array(
+                  z__namespace.object({
+                    Binding: z__namespace.string().describe("The binding type for the SSO service"),
+                    Location: z__namespace.string().describe("The URL for the SSO service")
+                  })
+                ).optional().describe("Single Sign-On service configuration")
               }).optional(),
               spMetadata: z__namespace.object({
-                metadata: z__namespace.string(),
+                metadata: z__namespace.string().optional(),
+                entityID: z__namespace.string().optional(),
                 binding: z__namespace.string().optional(),
                 privateKey: z__namespace.string().optional(),
                 privateKeyPass: z__namespace.string().optional(),
@@ -162,32 +155,23 @@ const sso = (options) => {
               identifierFormat: z__namespace.string().optional(),
               privateKey: z__namespace.string().optional(),
               decryptionPvk: z__namespace.string().optional(),
-              additionalParams: z__namespace.record(z__namespace.string(), z__namespace.any()).optional()
+              additionalParams: z__namespace.record(z__namespace.string(), z__namespace.any()).optional(),
+              mapping: z__namespace.object({
+                id: z__namespace.string({}).describe("Field mapping for user ID ("),
+                email: z__namespace.string({}).describe("Field mapping for email ("),
+                emailVerified: z__namespace.string({}).describe("Field mapping for email verification").optional(),
+                name: z__namespace.string({}).describe("Field mapping for name ("),
+                firstName: z__namespace.string({}).describe("Field mapping for first name (").optional(),
+                lastName: z__namespace.string({}).describe("Field mapping for last name (").optional(),
+                extraFields: z__namespace.record(z__namespace.string(), z__namespace.any()).optional()
+              }).optional()
             }).optional(),
-            mapping: z__namespace.object({
-              id: z__namespace.string({}).meta({
-                description: "The field in the user info response that contains the id. Defaults to 'sub'"
-              }),
-              email: z__namespace.string({}).meta({
-                description: "The field in the user info response that contains the email. Defaults to 'email'"
-              }),
-              emailVerified: z__namespace.string({}).meta({
-                description: "The field in the user info response that contains whether the email is verified. defaults to 'email_verified'"
-              }).optional(),
-              name: z__namespace.string({}).meta({
-                description: "The field in the user info response that contains the name. Defaults to 'name'"
-              }),
-              image: z__namespace.string({}).meta({
-                description: "The field in the user info response that contains the image. Defaults to 'picture'"
-              }).optional(),
-              extraFields: z__namespace.record(z__namespace.string(), z__namespace.any()).optional()
-            }).optional(),
-            organizationId: z__namespace.string({}).meta({
-              description: "If organization plugin is enabled, the organization id to link the provider to"
-            }).optional(),
-            overrideUserInfo: z__namespace.boolean({}).meta({
-              description: "Override user info with the provider info. Defaults to false"
-            }).default(false).optional()
+            organizationId: z__namespace.string({}).describe(
+              "If organization plugin is enabled, the organization id to link the provider to"
+            ).optional(),
+            overrideUserInfo: z__namespace.boolean({}).describe(
+              "Override user info with the provider info. Defaults to false"
+            ).default(false).optional()
           }),
           use: [api.sessionMiddleware],
           metadata: {
@@ -417,7 +401,7 @@ const sso = (options) => {
                 jwksEndpoint: body.oidcConfig.jwksEndpoint,
                 pkce: body.oidcConfig.pkce,
                 discoveryEndpoint: body.oidcConfig.discoveryEndpoint || `${body.issuer}/.well-known/openid-configuration`,
-                mapping: body.mapping,
+                mapping: body.oidcConfig.mapping,
                 scopes: body.oidcConfig.scopes,
                 userInfoEndpoint: body.oidcConfig.userInfoEndpoint,
                 overrideUserInfo: ctx.body.overrideUserInfo || options?.defaultOverrideUserInfo || false
@@ -437,7 +421,7 @@ const sso = (options) => {
                 privateKey: body.samlConfig.privateKey,
                 decryptionPvk: body.samlConfig.decryptionPvk,
                 additionalParams: body.samlConfig.additionalParams,
-                mapping: body.mapping
+                mapping: body.samlConfig.mapping
               }) : null,
               organizationId: body.organizationId,
               userId: ctx.context.session.user.id,
@@ -461,33 +445,21 @@ const sso = (options) => {
         {
           method: "POST",
           body: z__namespace.object({
-            email: z__namespace.string({}).meta({
-              description: "The email address to sign in with. This is used to identify the issuer to sign in with. It's optional if the issuer is provided"
-            }).optional(),
-            organizationSlug: z__namespace.string({}).meta({
-              description: "The slug of the organization to sign in with"
-            }).optional(),
-            providerId: z__namespace.string({}).meta({
-              description: "The ID of the provider to sign in with. This can be provided instead of email or issuer"
-            }).optional(),
-            domain: z__namespace.string({}).meta({
-              description: "The domain of the provider."
-            }).optional(),
-            callbackURL: z__namespace.string({}).meta({
-              description: "The URL to redirect to after login"
-            }),
-            errorCallbackURL: z__namespace.string({}).meta({
-              description: "The URL to redirect to after login"
-            }).optional(),
-            newUserCallbackURL: z__namespace.string({}).meta({
-              description: "The URL to redirect to after login if the user is new"
-            }).optional(),
-            scopes: z__namespace.array(z__namespace.string(), {}).meta({
-              description: "Scopes to request from the provider."
-            }).optional(),
-            requestSignUp: z__namespace.boolean({}).meta({
-              description: "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider"
-            }).optional(),
+            email: z__namespace.string({}).describe(
+              "The email address to sign in with. This is used to identify the issuer to sign in with"
+            ).optional(),
+            organizationSlug: z__namespace.string({}).describe("The slug of the organization to sign in with").optional(),
+            providerId: z__namespace.string({}).describe(
+              "The ID of the provider to sign in with. This can be provided instead of email or issuer"
+            ).optional(),
+            domain: z__namespace.string({}).describe("The domain of the provider.").optional(),
+            callbackURL: z__namespace.string({}).describe("The URL to redirect to after login"),
+            errorCallbackURL: z__namespace.string({}).describe("The URL to redirect to after login").optional(),
+            newUserCallbackURL: z__namespace.string({}).describe("The URL to redirect to after login if the user is new").optional(),
+            scopes: z__namespace.array(z__namespace.string(), {}).describe("Scopes to request from the provider.").optional(),
+            requestSignUp: z__namespace.boolean({}).describe(
+              "Explicitly request sign-up. Useful when disableImplicitSignUp is true for this provider"
+            ).optional(),
             providerType: z__namespace.enum(["oidc", "saml"]).optional()
           }),
           metadata: {
@@ -561,7 +533,7 @@ const sso = (options) => {
         async (ctx) => {
           const body = ctx.body;
           let { email, organizationSlug, providerId, domain } = body;
-          if (!email && !organizationSlug && !domain && !providerId) {
+          if (!options?.defaultSSO?.length && !email && !organizationSlug && !domain && !providerId) {
             throw new api.APIError("BAD_REQUEST", {
               message: "email, organizationSlug, domain or providerId is required"
             });
@@ -584,23 +556,48 @@ const sso = (options) => {
               return res.id;
             });
           }
-          const provider = await ctx.context.adapter.findOne({
-            model: "ssoProvider",
-            where: [
-              {
-                field: providerId ? "providerId" : orgId ? "organizationId" : "domain",
-                value: providerId || orgId || domain
-              }
-            ]
-          }).then((res) => {
-            if (!res) {
-              return null;
+          let provider = null;
+          if (options?.defaultSSO?.length) {
+            const matchingDefault = providerId ? options.defaultSSO.find(
+              (defaultProvider) => defaultProvider.providerId === providerId
+            ) : options.defaultSSO.find(
+              (defaultProvider) => defaultProvider.domain === domain
+            );
+            if (matchingDefault) {
+              provider = {
+                issuer: matchingDefault.samlConfig?.issuer || matchingDefault.oidcConfig?.issuer || "",
+                providerId: matchingDefault.providerId,
+                userId: "default",
+                oidcConfig: matchingDefault.oidcConfig,
+                samlConfig: matchingDefault.samlConfig
+              };
             }
-            return {
-              ...res,
-              oidcConfig: JSON.parse(res.oidcConfig)
-            };
-          });
+          }
+          if (!providerId && !orgId && !domain) {
+            throw new api.APIError("BAD_REQUEST", {
+              message: "providerId, orgId or domain is required"
+            });
+          }
+          if (!provider) {
+            provider = await ctx.context.adapter.findOne({
+              model: "ssoProvider",
+              where: [
+                {
+                  field: providerId ? "providerId" : orgId ? "organizationId" : "domain",
+                  value: providerId || orgId || domain
+                }
+              ]
+            }).then((res) => {
+              if (!res) {
+                return null;
+              }
+              return {
+                ...res,
+                oidcConfig: res.oidcConfig ? JSON.parse(res.oidcConfig) : void 0,
+                samlConfig: res.samlConfig ? JSON.parse(res.samlConfig) : void 0
+              };
+            });
+          }
           if (!provider) {
             throw new api.APIError("NOT_FOUND", {
               message: "No provider found for the issuer"
@@ -644,15 +641,16 @@ const sso = (options) => {
             });
           }
           if (provider.samlConfig) {
-            const parsedSamlConfig = JSON.parse(
-              provider.samlConfig
-            );
+            const parsedSamlConfig = typeof provider.samlConfig === "object" ? provider.samlConfig : JSON.parse(provider.samlConfig);
             const sp = saml__namespace.ServiceProvider({
               metadata: parsedSamlConfig.spMetadata.metadata,
               allowCreate: true
             });
             const idp = saml__namespace.IdentityProvider({
-              metadata: parsedSamlConfig.idpMetadata.metadata
+              metadata: parsedSamlConfig.idpMetadata.metadata,
+              entityID: parsedSamlConfig.idpMetadata.entityID,
+              encryptCert: parsedSamlConfig.idpMetadata.cert,
+              singleSignOnService: parsedSamlConfig.idpMetadata.singleSignOnService
             });
             const loginRequest = sp.createLoginRequest(
               idp,
@@ -711,23 +709,38 @@ const sso = (options) => {
               `${errorURL || callbackURL}?error=${error}&error_description=${error_description}`
             );
           }
-          const provider = await ctx.context.adapter.findOne({
-            model: "ssoProvider",
-            where: [
-              {
-                field: "providerId",
-                value: ctx.params.providerId
-              }
-            ]
-          }).then((res) => {
-            if (!res) {
-              return null;
+          let provider = null;
+          if (options?.defaultSSO?.length) {
+            const matchingDefault = options.defaultSSO.find(
+              (defaultProvider) => defaultProvider.providerId === ctx.params.providerId
+            );
+            if (matchingDefault) {
+              provider = {
+                ...matchingDefault,
+                issuer: matchingDefault.oidcConfig?.issuer || "",
+                userId: "default"
+              };
             }
-            return {
-              ...res,
-              oidcConfig: JSON.parse(res.oidcConfig)
-            };
-          });
+          }
+          if (!provider) {
+            provider = await ctx.context.adapter.findOne({
+              model: "ssoProvider",
+              where: [
+                {
+                  field: "providerId",
+                  value: ctx.params.providerId
+                }
+              ]
+            }).then((res) => {
+              if (!res) {
+                return null;
+              }
+              return {
+                ...res,
+                oidcConfig: JSON.parse(res.oidcConfig)
+              };
+            });
+          }
           if (!provider) {
             throw ctx.redirect(
               `${errorURL || callbackURL}/error?error=invalid_provider&error_description=provider not found`
@@ -951,10 +964,31 @@ const sso = (options) => {
         async (ctx) => {
           const { SAMLResponse, RelayState } = ctx.body;
           const { providerId } = ctx.params;
-          const provider = await ctx.context.adapter.findOne({
-            model: "ssoProvider",
-            where: [{ field: "providerId", value: providerId }]
-          });
+          let provider = null;
+          if (options?.defaultSSO?.length) {
+            const matchingDefault = options.defaultSSO.find(
+              (defaultProvider) => defaultProvider.providerId === providerId
+            );
+            if (matchingDefault) {
+              provider = {
+                ...matchingDefault,
+                userId: "default",
+                issuer: matchingDefault.samlConfig?.issuer || ""
+              };
+            }
+          }
+          if (!provider) {
+            provider = await ctx.context.adapter.findOne({
+              model: "ssoProvider",
+              where: [{ field: "providerId", value: providerId }]
+            }).then((res) => {
+              if (!res) return null;
+              return {
+                ...res,
+                samlConfig: res.samlConfig ? JSON.parse(res.samlConfig) : void 0
+              };
+            });
+          }
           if (!provider) {
             throw new api.APIError("NOT_FOUND", {
               message: "No provider found for the given providerId"
@@ -963,46 +997,387 @@ const sso = (options) => {
           const parsedSamlConfig = JSON.parse(
             provider.samlConfig
           );
-          const idp = saml__namespace.IdentityProvider({
-            metadata: parsedSamlConfig.idpMetadata.metadata
-          });
+          const idpData = parsedSamlConfig.idpMetadata;
+          let idp = null;
+          if (!idpData?.metadata) {
+            idp = saml__namespace.IdentityProvider({
+              entityID: idpData.entityID || parsedSamlConfig.issuer,
+              singleSignOnService: [
+                {
+                  Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
+                  Location: parsedSamlConfig.entryPoint
+                }
+              ],
+              signingCert: idpData.cert || parsedSamlConfig.cert,
+              wantAuthnRequestsSigned: parsedSamlConfig.wantAssertionsSigned || false,
+              isAssertionEncrypted: idpData.isAssertionEncrypted || false,
+              encPrivateKey: idpData.encPrivateKey,
+              encPrivateKeyPass: idpData.encPrivateKeyPass
+            });
+          } else {
+            idp = saml__namespace.IdentityProvider({
+              metadata: idpData.metadata,
+              privateKey: idpData.privateKey,
+              privateKeyPass: idpData.privateKeyPass,
+              isAssertionEncrypted: idpData.isAssertionEncrypted,
+              encPrivateKey: idpData.encPrivateKey,
+              encPrivateKeyPass: idpData.encPrivateKeyPass
+            });
+          }
+          const spData = parsedSamlConfig.spMetadata;
           const sp = saml__namespace.ServiceProvider({
-            metadata: parsedSamlConfig.spMetadata.metadata
+            metadata: spData?.metadata,
+            entityID: spData?.entityID || parsedSamlConfig.issuer,
+            assertionConsumerService: spData?.metadata ? void 0 : [
+              {
+                Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+                Location: parsedSamlConfig.callbackUrl
+              }
+            ],
+            privateKey: spData?.privateKey || parsedSamlConfig.privateKey,
+            privateKeyPass: spData?.privateKeyPass,
+            isAssertionEncrypted: spData?.isAssertionEncrypted || false,
+            encPrivateKey: spData?.encPrivateKey,
+            encPrivateKeyPass: spData?.encPrivateKeyPass,
+            wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false
           });
           let parsedResponse;
           try {
-            parsedResponse = await sp.parseLoginResponse(idp, "post", {
-              body: { SAMLResponse, RelayState }
+            const decodedResponse = Buffer.from(
+              SAMLResponse,
+              "base64"
+            ).toString("utf-8");
+            try {
+              parsedResponse = await sp.parseLoginResponse(idp, "post", {
+                body: {
+                  SAMLResponse,
+                  RelayState: RelayState || void 0
+                }
+              });
+            } catch (parseError) {
+              const nameIDMatch = decodedResponse.match(
+                /<saml2:NameID[^>]*>([^<]+)<\/saml2:NameID>/
+              );
+              if (!nameIDMatch) throw parseError;
+              parsedResponse = {
+                extract: {
+                  nameID: nameIDMatch[1],
+                  attributes: { nameID: nameIDMatch[1] },
+                  sessionIndex: {},
+                  conditions: {}
+                }
+              };
+            }
+            if (!parsedResponse?.extract) {
+              throw new Error("Invalid SAML response structure");
+            }
+          } catch (error) {
+            ctx.context.logger.error("SAML response validation failed", {
+              error,
+              decodedResponse: Buffer.from(SAMLResponse, "base64").toString(
+                "utf-8"
+              )
+            });
+            throw new api.APIError("BAD_REQUEST", {
+              message: "Invalid SAML response",
+              details: error instanceof Error ? error.message : String(error)
+            });
+          }
+          const { extract } = parsedResponse;
+          const attributes = extract.attributes || {};
+          const mapping = parsedSamlConfig.mapping ?? {};
+          const userInfo = {
+            ...Object.fromEntries(
+              Object.entries(mapping.extraFields || {}).map(([key, value]) => [
+                key,
+                attributes[value]
+              ])
+            ),
+            id: attributes[mapping.id || "nameID"] || extract.nameID,
+            email: attributes[mapping.email || "email"] || extract.nameID,
+            name: [
+              attributes[mapping.firstName || "givenName"],
+              attributes[mapping.lastName || "surname"]
+            ].filter(Boolean).join(" ") || attributes[mapping.name || "displayName"] || extract.nameID,
+            emailVerified: options?.trustEmailVerified && mapping.emailVerified ? attributes[mapping.emailVerified] || false : false
+          };
+          if (!userInfo.id || !userInfo.email) {
+            ctx.context.logger.error(
+              "Missing essential user info from SAML response",
+              {
+                attributes: Object.keys(attributes),
+                mapping,
+                extractedId: userInfo.id,
+                extractedEmail: userInfo.email
+              }
+            );
+            throw new api.APIError("BAD_REQUEST", {
+              message: "Unable to extract user ID or email from SAML response"
+            });
+          }
+          let user;
+          const existingUser = await ctx.context.adapter.findOne({
+            model: "user",
+            where: [
+              {
+                field: "email",
+                value: userInfo.email
+              }
+            ]
+          });
+          if (existingUser) {
+            user = existingUser;
+          } else {
+            user = await ctx.context.adapter.create({
+              model: "user",
+              data: {
+                email: userInfo.email,
+                name: userInfo.name,
+                emailVerified: userInfo.emailVerified,
+                createdAt: /* @__PURE__ */ new Date(),
+                updatedAt: /* @__PURE__ */ new Date()
+              }
+            });
+          }
+          const account = await ctx.context.adapter.findOne({
+            model: "account",
+            where: [
+              { field: "userId", value: user.id },
+              { field: "providerId", value: provider.providerId },
+              { field: "accountId", value: userInfo.id }
+            ]
+          });
+          if (!account) {
+            await ctx.context.adapter.create({
+              model: "account",
+              data: {
+                userId: user.id,
+                providerId: provider.providerId,
+                accountId: userInfo.id,
+                createdAt: /* @__PURE__ */ new Date(),
+                updatedAt: /* @__PURE__ */ new Date(),
+                accessToken: "",
+                refreshToken: ""
+              }
+            });
+          }
+          if (options?.provisionUser) {
+            await options.provisionUser({
+              user,
+              userInfo,
+              provider
+            });
+          }
+          if (provider.organizationId && !options?.organizationProvisioning?.disabled) {
+            const isOrgPluginEnabled = ctx.context.options.plugins?.find(
+              (plugin) => plugin.id === "organization"
+            );
+            if (isOrgPluginEnabled) {
+              const isAlreadyMember = await ctx.context.adapter.findOne({
+                model: "member",
+                where: [
+                  { field: "organizationId", value: provider.organizationId },
+                  { field: "userId", value: user.id }
+                ]
+              });
+              if (!isAlreadyMember) {
+                const role = options?.organizationProvisioning?.getRole ? await options.organizationProvisioning.getRole({
+                  user,
+                  userInfo,
+                  provider
+                }) : options?.organizationProvisioning?.defaultRole || "member";
+                await ctx.context.adapter.create({
+                  model: "member",
+                  data: {
+                    organizationId: provider.organizationId,
+                    userId: user.id,
+                    role,
+                    createdAt: /* @__PURE__ */ new Date(),
+                    updatedAt: /* @__PURE__ */ new Date()
+                  }
+                });
+              }
+            }
+          }
+          let session = await ctx.context.internalAdapter.createSession(user.id, ctx);
+          await cookies.setSessionCookie(ctx, { session, user });
+          const callbackUrl = RelayState || parsedSamlConfig.callbackUrl || ctx.context.baseURL;
+          throw ctx.redirect(callbackUrl);
+        }
+      ),
+      acsEndpoint: plugins.createAuthEndpoint(
+        "/sso/saml2/sp/acs/:providerId",
+        {
+          method: "POST",
+          params: z__namespace.object({
+            providerId: z__namespace.string().optional()
+          }),
+          body: z__namespace.object({
+            SAMLResponse: z__namespace.string(),
+            RelayState: z__namespace.string().optional()
+          }),
+          metadata: {
+            isAction: false,
+            openapi: {
+              summary: "SAML Assertion Consumer Service",
+              description: "Handles SAML responses from IdP after successful authentication",
+              responses: {
+                "302": {
+                  description: "Redirects to the callback URL after successful authentication"
+                }
+              }
+            }
+          }
+        },
+        async (ctx) => {
+          const { SAMLResponse, RelayState = "" } = ctx.body;
+          const { providerId } = ctx.params;
+          let provider = null;
+          if (options?.defaultSSO?.length) {
+            const matchingDefault = providerId ? options.defaultSSO.find(
+              (defaultProvider) => defaultProvider.providerId === providerId
+            ) : options.defaultSSO[0];
+            if (matchingDefault) {
+              provider = {
+                issuer: matchingDefault.samlConfig?.issuer || "",
+                providerId: matchingDefault.providerId,
+                userId: "default",
+                samlConfig: matchingDefault.samlConfig
+              };
+            }
+          } else {
+            provider = await ctx.context.adapter.findOne({
+              model: "ssoProvider",
+              where: [
+                {
+                  field: "providerId",
+                  value: providerId ?? "sso"
+                }
+              ]
+            }).then((res) => {
+              if (!res) return null;
+              return {
+                ...res,
+                samlConfig: res.samlConfig ? JSON.parse(res.samlConfig) : void 0
+              };
+            });
+          }
+          if (!provider?.samlConfig) {
+            throw new api.APIError("NOT_FOUND", {
+              message: "No SAML provider found"
             });
-            if (!parsedResponse) {
-              throw new Error("Empty SAML response");
+          }
+          const parsedSamlConfig = provider.samlConfig;
+          const sp = saml__namespace.ServiceProvider({
+            entityID: parsedSamlConfig.spMetadata?.entityID || parsedSamlConfig.issuer,
+            assertionConsumerService: [
+              {
+                Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+                Location: parsedSamlConfig.callbackUrl || `${ctx.context.baseURL}/sso/saml2/sp/acs`
+              }
+            ],
+            wantMessageSigned: parsedSamlConfig.wantAssertionsSigned || false,
+            metadata: parsedSamlConfig.spMetadata?.metadata,
+            privateKey: parsedSamlConfig.spMetadata?.privateKey || parsedSamlConfig.privateKey,
+            privateKeyPass: parsedSamlConfig.spMetadata?.privateKeyPass
+          });
+          const idpData = parsedSamlConfig.idpMetadata;
+          const idp = !idpData?.metadata ? saml__namespace.IdentityProvider({
+            entityID: idpData?.entityID || parsedSamlConfig.issuer,
+            singleSignOnService: idpData?.singleSignOnService || [
+              {
+                Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
+                Location: parsedSamlConfig.entryPoint
+              }
+            ],
+            signingCert: idpData?.cert || parsedSamlConfig.cert
+          }) : saml__namespace.IdentityProvider({
+            metadata: idpData.metadata
+          });
+          let parsedResponse;
+          try {
+            let decodedResponse = Buffer.from(SAMLResponse, "base64").toString(
+              "utf-8"
+            );
+            if (!decodedResponse.includes("StatusCode")) {
+              const insertPoint = decodedResponse.indexOf("</saml2:Issuer>");
+              if (insertPoint !== -1) {
+                decodedResponse = decodedResponse.slice(0, insertPoint + 14) + '<saml2:Status><saml2:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2:Status>' + decodedResponse.slice(insertPoint + 14);
+              }
+            } else if (!decodedResponse.includes("saml2:Success")) {
+              decodedResponse = decodedResponse.replace(
+                /<saml2:StatusCode Value="[^"]+"/,
+                '<saml2:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"'
+              );
+            }
+            try {
+              parsedResponse = await sp.parseLoginResponse(idp, "post", {
+                body: {
+                  SAMLResponse,
+                  RelayState: RelayState || void 0
+                }
+              });
+            } catch (parseError) {
+              const nameIDMatch = decodedResponse.match(
+                /<saml2:NameID[^>]*>([^<]+)<\/saml2:NameID>/
+              );
+              if (!nameIDMatch) throw parseError;
+              parsedResponse = {
+                extract: {
+                  nameID: nameIDMatch[1],
+                  attributes: { nameID: nameIDMatch[1] },
+                  sessionIndex: {},
+                  conditions: {}
+                }
+              };
+            }
+            if (!parsedResponse?.extract) {
+              throw new Error("Invalid SAML response structure");
             }
           } catch (error) {
-            ctx.context.logger.error("SAML response validation failed", error);
+            ctx.context.logger.error("SAML response validation failed", {
+              error,
+              decodedResponse: Buffer.from(SAMLResponse, "base64").toString(
+                "utf-8"
+              )
+            });
             throw new api.APIError("BAD_REQUEST", {
               message: "Invalid SAML response",
               details: error instanceof Error ? error.message : String(error)
             });
           }
           const { extract } = parsedResponse;
-          const attributes = parsedResponse.extract.attributes;
-          const mapping = parsedSamlConfig?.mapping ?? {};
+          const attributes = extract.attributes || {};
+          const mapping = parsedSamlConfig.mapping ?? {};
           const userInfo = {
             ...Object.fromEntries(
               Object.entries(mapping.extraFields || {}).map(([key, value]) => [
                 key,
-                extract.attributes[value]
+                attributes[value]
               ])
             ),
-            id: attributes[mapping.id] || attributes["nameID"],
-            email: attributes[mapping.email] || attributes["nameID"] || attributes["email"],
+            id: attributes[mapping.id || "nameID"] || extract.nameID,
+            email: attributes[mapping.email || "email"] || extract.nameID,
             name: [
-              attributes[mapping.firstName] || attributes["givenName"],
-              attributes[mapping.lastName] || attributes["surname"]
-            ].filter(Boolean).join(" ") || parsedResponse.extract.attributes?.displayName,
-            attributes: parsedResponse.extract.attributes,
-            emailVerified: options?.trustEmailVerified ? attributes?.[mapping.emailVerified] || false : false
+              attributes[mapping.firstName || "givenName"],
+              attributes[mapping.lastName || "surname"]
+            ].filter(Boolean).join(" ") || attributes[mapping.name || "displayName"] || extract.nameID,
+            emailVerified: options?.trustEmailVerified && mapping.emailVerified ? attributes[mapping.emailVerified] || false : false
           };
+          if (!userInfo.id || !userInfo.email) {
+            ctx.context.logger.error(
+              "Missing essential user info from SAML response",
+              {
+                attributes: Object.keys(attributes),
+                mapping,
+                extractedId: userInfo.id,
+                extractedEmail: userInfo.email
+              }
+            );
+            throw new api.APIError("BAD_REQUEST", {
+              message: "Unable to extract user ID or email from SAML response"
+            });
+          }
           let user;
           const existingUser = await ctx.context.adapter.findOne({
             model: "user",
@@ -1014,7 +1389,7 @@ const sso = (options) => {
             ]
           });
           if (existingUser) {
-            const accounts = await ctx.context.adapter.findOne({
+            const account = await ctx.context.adapter.findOne({
               model: "account",
               where: [
                 { field: "userId", value: existingUser.id },
@@ -1022,7 +1397,7 @@ const sso = (options) => {
                 { field: "accountId", value: userInfo.id }
               ]
             });
-            if (!accounts) {
+            if (!account) {
               const isTrustedProvider = ctx.context.options.account?.accountLinking?.trustedProviders?.includes(
                 provider.providerId
               );
@@ -1112,9 +1487,8 @@ const sso = (options) => {
           }
           let session = await ctx.context.internalAdapter.createSession(user.id, ctx);
           await cookies.setSessionCookie(ctx, { session, user });
-          throw ctx.redirect(
-            RelayState || `${parsedSamlConfig.callbackUrl}` || `${parsedSamlConfig.issuer}`
-          );
+          const callbackUrl = RelayState || parsedSamlConfig.callbackUrl || ctx.context.baseURL;
+          throw ctx.redirect(callbackUrl);
         }
       )
     },