@better-auth/sso 1.7.0-rc.0 → 1.7.0-rc.2

package/dist/index.mjs

@@ -1,24 +1,25 @@
-import { t as PACKAGE_VERSION } from "./version-BDD29zmX.mjs";
+import { t as PACKAGE_VERSION } from "./version-m-Zfjx6T.mjs";
 import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
 import { getHostname } from "tldts";
 import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
-import { getCurrentAdapter, runWithTransaction } from "@better-auth/core/context";
+import { getCurrentAdapter, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { filterOutputFields } from "@better-auth/core/utils/db";
 import { classifyHost, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { betterFetch } from "@better-fetch/fetch";
-import { createRemoteJWKSet, customFetch, decodeJwt, jwtVerify } from "jose";
-import { base64 } from "@better-auth/utils/base64";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
+import { base64, base64Url } from "@better-auth/utils/base64";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
+import * as samlifyNamespace from "samlify";
+import samlifyDefault from "samlify";
 import { parseInputData, toZodSchema } from "better-auth/db";
 import { isAPIError } from "@better-auth/core/utils/is-api-error";
 import { HIDE_METADATA, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, generateGenericState, generateState, getOAuth2Tokens, parseGenericState, parseState } from "better-auth";
-import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
+import { deleteSessionCookie, setAccountCookie, setSessionCookie } from "better-auth/cookies";
 import { additionalAuthorizationParamsSchema, handleOAuthUserInfo } from "better-auth/oauth2";
-import * as samlifyNamespace from "samlify";
-import samlifyDefault from "samlify";
+import { createHash } from "@better-auth/utils/hash";
 //#region src/constants.ts
 /**
 * SAML Constants
@@ -60,6 +61,8 @@ const DEFAULT_MAX_SAML_RESPONSE_SIZE = 256 * 1024;
 const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;
 //#endregion
 //#region src/utils.ts
+const unsafeSAMLRedirectPathPrefix = /^\/(?:\/|\\|%2f|%5c)/i;
+const isSafeSAMLRedirectPath = (url) => url.startsWith("/") && !unsafeSAMLRedirectPathPrefix.test(url);
 /**
 * Safely parses a value that might be a JSON string or already a parsed object.
 * This handles cases where ORMs like Drizzle might return already parsed objects
@@ -515,15 +518,21 @@ async function fetchOIDCEndpointResponse(name, endpoint, init, isTrustedOrigin)
 	if (isHttpRedirectStatus(response.status)) throwRedirectError(name, endpoint, response.status, response.headers.get("location"));
 	return response;
 }
+/** Enforces the OpenID Connect authorized-party rules for ID Tokens. */
+function assertOIDCAuthorizedParty(payload, clientId) {
+	if (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp === void 0 || payload.azp !== void 0 && payload.azp !== clientId) throw new Error("OIDC ID token authorized party does not match the client");
+}
 /**
 * Validate an OIDC ID token using the same endpoint fetch policy as the rest of
 * the SSO OIDC flow.
 */
 async function validateOIDCIdToken(token, jwksEndpoint, options, isTrustedOrigin) {
-	return jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: (url, init) => fetchOIDCEndpointResponse("jwksEndpoint", url, init, isTrustedOrigin) }), {
+	const verified = await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: (url, init) => fetchOIDCEndpointResponse("jwksEndpoint", url, init, isTrustedOrigin) }), {
 		audience: options.audience,
 		issuer: options.issuer
 	});
+	if (typeof options.audience === "string") assertOIDCAuthorizedParty(verified.payload, options.audience);
+	return verified;
 }
 /**
 * Fetch the OIDC discovery document from the IdP.
@@ -1301,8 +1310,131 @@ function validateAudience(c, ctx) {
 		throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Audience mismatch"));
 	}
 }
+const saml = typeof samlifyNamespace.SPMetadata === "function" && typeof samlifyNamespace.setSchemaValidator === "function" ? samlifyNamespace : samlifyDefault ?? samlifyNamespace;
+//#endregion
+//#region src/routes/helpers.ts
+/**
+* Same as `normalizePem`, but applied across the resolved list of IdP signing
+* certificates so multi-cert rotation configs survive the line-trim step.
+*/
+function normalizePemList(certs) {
+	if (!certs) return certs;
+	return certs.map((pem) => normalizePem(pem) ?? pem);
+}
+async function findSAMLProvider(providerId, options, adapter) {
+	if (options?.defaultSSO?.length) {
+		const match = options.defaultSSO.find((p) => p.providerId === providerId);
+		if (match) return {
+			...match,
+			userId: "default",
+			issuer: match.samlConfig?.issuer || "",
+			...options.domainVerification?.enabled ? { domainVerified: true } : {}
+		};
+	}
+	const res = await adapter.findOne({
+		model: "ssoProvider",
+		where: [{
+			field: "providerId",
+			value: providerId
+		}]
+	});
+	if (!res) return null;
+	return {
+		...res,
+		samlConfig: res.samlConfig ? safeJsonParse(res.samlConfig) || void 0 : void 0
+	};
+}
+function createSP(config, baseURL, providerId, opts) {
+	const spData = config.spMetadata;
+	const sloLocation = `${baseURL}/sso/saml2/sp/slo/${providerId}`;
+	const acsUrl = `${baseURL}/sso/saml2/sp/acs/${providerId}`;
+	let metadata = spData?.metadata;
+	if (!metadata) metadata = saml.SPMetadata({
+		entityID: spData?.entityID || config.issuer,
+		assertionConsumerService: [{
+			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+			Location: acsUrl
+		}],
+		singleLogoutService: opts?.sloOptions ? [{
+			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+			Location: sloLocation
+		}, {
+			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
+			Location: sloLocation
+		}] : void 0,
+		wantMessageSigned: config.wantAssertionsSigned || false,
+		authnRequestsSigned: config.authnRequestsSigned || false,
+		nameIDFormat: config.identifierFormat ? [config.identifierFormat] : void 0
+	}).getMetadata() || "";
+	return saml.ServiceProvider({
+		metadata,
+		allowCreate: true,
+		wantLogoutRequestSigned: opts?.sloOptions?.wantLogoutRequestSigned ?? false,
+		wantLogoutResponseSigned: opts?.sloOptions?.wantLogoutResponseSigned ?? false,
+		privateKey: normalizePem(spData?.privateKey || config.privateKey),
+		privateKeyPass: spData?.privateKeyPass,
+		isAssertionEncrypted: spData?.isAssertionEncrypted || false,
+		encPrivateKey: normalizePem(spData?.encPrivateKey),
+		encPrivateKeyPass: spData?.encPrivateKeyPass,
+		relayState: opts?.relayState,
+		clockDrifts: opts?.clockSkew && opts?.clockSkew !== 0 ? [-opts.clockSkew, opts.clockSkew] : void 0
+	});
+}
+function assertSAMLIdentityProviderAuthority(config) {
+	if (config.idpMetadata?.metadata || config.idpMetadata?.entityID) return;
+	throw new APIError("BAD_REQUEST", { message: "SAML manual IdP configuration requires idpMetadata.entityID; issuer identifies the service provider and cannot identify the IdP" });
+}
+function createIdP(config) {
+	assertSAMLIdentityProviderAuthority(config);
+	const idpData = config.idpMetadata;
+	if (idpData?.metadata) return saml.IdentityProvider({
+		metadata: idpData.metadata,
+		privateKey: normalizePem(idpData.privateKey),
+		privateKeyPass: idpData.privateKeyPass,
+		isAssertionEncrypted: idpData.isAssertionEncrypted,
+		encPrivateKey: normalizePem(idpData.encPrivateKey),
+		encPrivateKeyPass: idpData.encPrivateKeyPass
+	});
+	return saml.IdentityProvider({
+		entityID: idpData.entityID,
+		singleSignOnService: idpData.singleSignOnService || [{
+			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
+			Location: config.entryPoint
+		}],
+		singleLogoutService: idpData.singleLogoutService,
+		signingCert: normalizePemList(resolveSigningCerts(config)),
+		wantAuthnRequestsSigned: config.authnRequestsSigned || false,
+		isAssertionEncrypted: idpData.isAssertionEncrypted || false,
+		encPrivateKey: normalizePem(idpData.encPrivateKey),
+		encPrivateKeyPass: idpData.encPrivateKeyPass
+	});
+}
+function escapeHtml(str) {
+	if (!str) return "";
+	return String(str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function isSAMLPostBindingLocation(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	return url.protocol === "http:" || url.protocol === "https:";
+}
+function createSAMLPostForm(action, samlParam, samlValue, relayState) {
+	if (!isSAMLPostBindingLocation(action)) throw new APIError("BAD_REQUEST", { message: "SAML POST binding location must be an absolute http or https URL" });
+	const safeAction = escapeHtml(action);
+	const safeSamlParam = escapeHtml(samlParam);
+	const safeSamlValue = escapeHtml(samlValue);
+	const safeRelayState = relayState ? escapeHtml(relayState) : void 0;
+	const html = `<!DOCTYPE html><html><body onload="document.forms[0].submit();"><form method="POST" action="${safeAction}"><input type="hidden" name="${safeSamlParam}" value="${safeSamlValue}" />${safeRelayState ? `<input type="hidden" name="RelayState" value="${safeRelayState}" />` : ""}<noscript><input type="submit" value="Continue" /></noscript></form></body></html>`;
+	return new Response(html, { headers: { "Content-Type": "text/html" } });
+}
 //#endregion
 //#region src/routes/schemas.ts
+const absoluteUrlSchema = z.url();
+const samlRedirectUrlSchema = z.string().refine((url) => isSafeSAMLRedirectPath(url) || absoluteUrlSchema.safeParse(url).success, { message: "Expected an absolute URL or a relative path starting with /" });
 function getSSOProviderAdditionalFields$1(options) {
 	return options?.schema?.ssoProvider?.additionalFields ?? {};
 }
@@ -1327,16 +1459,14 @@ function parseSSOProviderAdditionalFields(options, data, action) {
 		action
 	});
 }
-const oidcMappingSchema = z.object({
-	id: z.string().meta({ description: "Field mapping for user ID (defaults to 'sub')" }),
+const oidcMappingSchema = z.strictObject({
 	email: z.string().meta({ description: "Field mapping for email (defaults to 'email')" }),
 	emailVerified: z.string().meta({ description: "Field mapping for email verification (defaults to 'email_verified')" }).optional(),
 	name: z.string().meta({ description: "Field mapping for name (defaults to 'name')" }),
 	image: z.string().meta({ description: "Field mapping for image (defaults to 'picture')" }).optional(),
 	extraFields: z.record(z.string(), z.any()).optional()
 }).optional();
-const samlMappingSchema = z.object({
-	id: z.string().meta({ description: "Field mapping for user ID (defaults to 'nameID')" }),
+const samlMappingSchema = z.strictObject({
 	email: z.string().meta({ description: "Field mapping for email (defaults to 'email')" }),
 	emailVerified: z.string().meta({ description: "Field mapping for email verification" }).optional(),
 	name: z.string().meta({ description: "Field mapping for name (defaults to 'displayName')" }),
@@ -1366,29 +1496,40 @@ const oidcConfigSchema = z.object({
 	overrideUserInfo: z.boolean().optional(),
 	mapping: oidcMappingSchema
 });
+const samlIdentityProviderConfigSchema = z.object({
+	cert: signingCertSchema.meta({ description: "IdP signing certificate(s). Pass a single PEM string or an array for rolling rotation. Takes precedence over the top-level `cert`." }).optional(),
+	privateKey: z.string().optional(),
+	privateKeyPass: z.string().optional(),
+	isAssertionEncrypted: z.boolean().optional(),
+	encPrivateKey: z.string().optional(),
+	encPrivateKeyPass: z.string().optional(),
+	singleSignOnService: z.array(z.object({
+		Binding: z.string().meta({ description: "The binding type for the SSO service" }),
+		Location: z.string().url().meta({ description: "The URL for the SSO service" })
+	})).meta({ description: "Single Sign-On service configuration" }).optional(),
+	singleLogoutService: z.array(z.object({
+		Binding: z.string(),
+		Location: z.string().url()
+	})).optional()
+});
+const samlIdentityProviderMetadataSchema = z.union([samlIdentityProviderConfigSchema.extend({
+	metadata: z.string().min(1),
+	entityID: z.string().optional()
+}), samlIdentityProviderConfigSchema.extend({
+	metadata: z.undefined().optional(),
+	entityID: z.string().min(1)
+})], "idpMetadata.entityID is required when IdP metadata XML is not provided");
+const samlIdentityProviderMetadataUpdateSchema = samlIdentityProviderConfigSchema.extend({
+	metadata: z.string().min(1).optional(),
+	entityID: z.string().min(1).optional()
+});
 const samlConfigSchema = z.object({
 	entryPoint: z.string().url().meta({ description: "The IdP SSO URL (entry point)" }),
 	cert: signingCertSchema.meta({ description: "IdP signing certificate(s). Pass a single PEM string or an array for rolling rotation. Omit when `idpMetadata.metadata` XML carries the certs. When both this and `idpMetadata.cert` are set, `idpMetadata.cert` wins." }).optional(),
 	audience: z.string().optional(),
 	callbackUrl: z.string().refine((url) => !url.includes("#"), { message: "callbackUrl must not contain a fragment" }).optional(),
-	idpMetadata: z.object({
-		metadata: z.string().optional(),
-		entityID: z.string().optional(),
-		cert: signingCertSchema.meta({ description: "IdP signing certificate(s). Pass a single PEM string or an array for rolling rotation. Takes precedence over the top-level `cert`." }).optional(),
-		privateKey: z.string().optional(),
-		privateKeyPass: z.string().optional(),
-		isAssertionEncrypted: z.boolean().optional(),
-		encPrivateKey: z.string().optional(),
-		encPrivateKeyPass: z.string().optional(),
-		singleSignOnService: z.array(z.object({
-			Binding: z.string().meta({ description: "The binding type for the SSO service" }),
-			Location: z.string().url().meta({ description: "The URL for the SSO service" })
-		})).meta({ description: "Single Sign-On service configuration" }).optional(),
-		singleLogoutService: z.array(z.object({
-			Binding: z.string(),
-			Location: z.string().url()
-		})).optional()
-	}).optional(),
+	idpInitiatedCallbackUrl: samlRedirectUrlSchema.optional(),
+	idpMetadata: samlIdentityProviderMetadataSchema,
 	spMetadata: z.object({
 		metadata: z.string().optional(),
 		entityID: z.string().optional(),
@@ -1423,7 +1564,10 @@ const updateSSOProviderBodySchema = z.object({
 	issuer: z.string().url().optional(),
 	domain: z.string().optional(),
 	oidcConfig: oidcConfigSchema.partial().optional(),
-	samlConfig: samlConfigSchema.partial().optional()
+	samlConfig: samlConfigSchema.omit({ idpMetadata: true }).partial().extend({
+		idpInitiatedCallbackUrl: samlRedirectUrlSchema.nullable().optional(),
+		idpMetadata: samlIdentityProviderMetadataUpdateSchema.optional()
+	}).optional()
 });
 function getUpdateSSOProviderBodySchema(options) {
 	return updateSSOProviderBodySchema.extend({
@@ -1454,12 +1598,12 @@ const SAML_IDP_BOUNDARY_FIELDS = [
 	"singleSignOnService"
 ];
 const SAML_SP_BOUNDARY_FIELDS = ["metadata", "entityID"];
-function isRecord(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stableStringify(value) {
 	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-	if (isRecord(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+	if (isRecord$2(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
 	return JSON.stringify(value) ?? String(value);
 }
 function identityValueChanged(current, updated) {
@@ -1469,10 +1613,10 @@ function hasChangedField(current, updated, fields) {
 	return fields.some((field) => identityValueChanged(current?.[field], updated?.[field]));
 }
 function oidcIdentityBoundaryChanged(current, updated) {
-	return hasChangedField(current, updated, OIDC_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(current.mapping?.id, updated.mapping?.id);
+	return hasChangedField(current, updated, OIDC_IDENTITY_BOUNDARY_FIELDS);
 }
 function samlIdentityBoundaryChanged(current, updated) {
-	return hasChangedField(current, updated, SAML_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(current.mapping?.id, updated.mapping?.id) || hasChangedField(current.idpMetadata, updated.idpMetadata, SAML_IDP_BOUNDARY_FIELDS) || hasChangedField(current.spMetadata, updated.spMetadata, SAML_SP_BOUNDARY_FIELDS);
+	return hasChangedField(current, updated, SAML_IDENTITY_BOUNDARY_FIELDS) || hasChangedField(current.idpMetadata, updated.idpMetadata, SAML_IDP_BOUNDARY_FIELDS) || hasChangedField(current.spMetadata, updated.spMetadata, SAML_SP_BOUNDARY_FIELDS);
 }
 function parseConfigSnapshot(config, configType) {
 	if (!config) return;
@@ -1499,14 +1643,12 @@ async function lockSSOProviderRow(adapter, providerId) {
 	});
 }
 async function lockSSOProviderForAccountLink(ctx, provider) {
+	if (typeof provider.id !== "string") return;
 	const lockedProvider = await lockSSOProviderRow(ctx.context.adapter, provider.providerId);
-	if (!lockedProvider) {
-		if (provider.userId === "default") return;
-		throw new APIError("CONFLICT", {
-			code: "SSO_PROVIDER_CHANGED",
-			message: "SSO provider changed while account linking was in progress"
-		});
-	}
+	if (!lockedProvider) throw new APIError("CONFLICT", {
+		code: "SSO_PROVIDER_CHANGED",
+		message: "SSO provider changed while account linking was in progress"
+	});
 	if (ssoProviderIdentityBoundaryChanged(provider, lockedProvider)) throw new APIError("CONFLICT", {
 		code: "SSO_PROVIDER_CHANGED",
 		message: "SSO provider changed while account linking was in progress"
@@ -1607,6 +1749,8 @@ function sanitizeProvider(provider, baseURL, options) {
 		} : void 0,
 		samlConfig: samlConfig ? {
 			entryPoint: samlConfig.entryPoint,
+			callbackUrl: samlConfig.callbackUrl,
+			idpInitiatedCallbackUrl: samlConfig.idpInitiatedCallbackUrl,
 			audience: samlConfig.audience,
 			wantAssertionsSigned: samlConfig.wantAssertionsSigned,
 			authnRequestsSigned: samlConfig.authnRequestsSigned,
@@ -1696,6 +1840,15 @@ function parseAndValidateConfig(configString, configType) {
 	if (!config) throw new APIError("BAD_REQUEST", { message: `Cannot update ${configType} config for a provider that doesn't have ${configType} configured` });
 	return config;
 }
+function mergeSAMLIdentityProviderMetadata(current, updates) {
+	if (!updates) return current;
+	const config = { idpMetadata: {
+		...current,
+		...updates
+	} };
+	assertSAMLIdentityProviderAuthority(config);
+	return config.idpMetadata;
+}
 function mergeSAMLConfig(current, updates, issuer) {
 	return {
 		...current,
@@ -1703,11 +1856,15 @@ function mergeSAMLConfig(current, updates, issuer) {
 		issuer,
 		entryPoint: updates.entryPoint ?? current.entryPoint,
 		cert: updates.cert ?? current.cert,
-		spMetadata: updates.spMetadata ?? current.spMetadata,
-		idpMetadata: updates.idpMetadata ?? current.idpMetadata,
+		spMetadata: updates.spMetadata ? {
+			...current.spMetadata,
+			...updates.spMetadata
+		} : current.spMetadata,
+		idpMetadata: mergeSAMLIdentityProviderMetadata(current.idpMetadata, updates.idpMetadata),
 		mapping: updates.mapping ?? current.mapping,
 		audience: updates.audience ?? current.audience,
 		callbackUrl: updates.callbackUrl ?? current.callbackUrl,
+		idpInitiatedCallbackUrl: updates.idpInitiatedCallbackUrl === null ? void 0 : updates.idpInitiatedCallbackUrl ?? current.idpInitiatedCallbackUrl,
 		wantAssertionsSigned: updates.wantAssertionsSigned ?? current.wantAssertionsSigned,
 		authnRequestsSigned: updates.authnRequestsSigned ?? current.authnRequestsSigned,
 		identifierFormat: updates.identifierFormat ?? current.identifierFormat,
@@ -1780,6 +1937,7 @@ const updateSSOProvider = (options) => {
 				const currentSamlConfig = parseAndValidateConfig(existingProvider.samlConfig, "SAML");
 				const updatedSamlConfig = mergeSAMLConfig(currentSamlConfig, body.samlConfig, updateData.issuer || currentSamlConfig.issuer || existingProvider.issuer);
 				validateCertSources(updatedSamlConfig);
+				assertSAMLIdentityProviderAuthority(updatedSamlConfig);
 				if (samlIdentityBoundaryChanged(currentSamlConfig, updatedSamlConfig)) providerIdentityBoundaryChanged = true;
 				updateData.samlConfig = JSON.stringify(updatedSamlConfig);
 			}
@@ -1986,6 +2144,80 @@ const verifyDomain = (options) => {
 	});
 };
 //#endregion
+//#region src/provider-reference.ts
+const SSO_PROVIDER_STATE_KEY = "ssoProviderReference";
+function serializeCanonical(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return `[${value.map((entry) => entry === void 0 ? "null" : serializeCanonical(entry)).join(",")}]`;
+	switch (typeof value) {
+		case "boolean":
+		case "number":
+		case "string": return JSON.stringify(value);
+		case "object": return `{${Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${serializeCanonical(entry)}`).join(",")}}`;
+		default: throw new TypeError("SSO provider configuration must be JSON-serializable");
+	}
+}
+function withoutOIDCSecret(configuration) {
+	if (!configuration) return void 0;
+	const result = { ...configuration };
+	result.clientSecret = void 0;
+	return result;
+}
+function getProviderSource(provider) {
+	return typeof provider.id === "string" && provider.id.length > 0 ? {
+		type: "persisted",
+		recordId: provider.id
+	} : { type: "configured" };
+}
+async function computeProviderAuthenticationFingerprint(provider) {
+	const digest = await createHash("SHA-256").digest(serializeCanonical({
+		domain: provider.domain,
+		domainVerified: "domainVerified" in provider ? provider.domainVerified : void 0,
+		issuer: provider.issuer,
+		organizationId: provider.organizationId,
+		oidcConfig: withoutOIDCSecret(provider.oidcConfig)
+	}));
+	return base64Url.encode(new Uint8Array(digest), { padding: false });
+}
+async function computeSSOProviderReference(provider) {
+	return {
+		providerId: provider.providerId,
+		source: getProviderSource(provider),
+		authenticationConfigurationFingerprint: await computeProviderAuthenticationFingerprint(provider)
+	};
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseSSOProviderReference(value) {
+	if (!isRecord$1(value) || !isRecord$1(value.source)) return null;
+	const providerId = value.providerId;
+	const authenticationConfigurationFingerprint = value.authenticationConfigurationFingerprint;
+	const source = value.source;
+	if (typeof providerId !== "string" || providerId.length === 0 || typeof authenticationConfigurationFingerprint !== "string" || authenticationConfigurationFingerprint.length === 0) return null;
+	if (source.type === "configured") return {
+		providerId,
+		source: { type: "configured" },
+		authenticationConfigurationFingerprint
+	};
+	if (source.type === "persisted" && typeof source.recordId === "string" && source.recordId.length > 0) return {
+		providerId,
+		source: {
+			type: "persisted",
+			recordId: source.recordId
+		},
+		authenticationConfigurationFingerprint
+	};
+	return null;
+}
+async function isCurrentSSOProviderReference(provider, reference) {
+	if (!reference || reference.providerId !== provider.providerId) return false;
+	const source = getProviderSource(provider);
+	if (source.type !== reference.source.type) return false;
+	if (source.type === "persisted" && (reference.source.type !== "persisted" || source.recordId !== reference.source.recordId)) return false;
+	return reference.authenticationConfigurationFingerprint === await computeProviderAuthenticationFingerprint(provider);
+}
+//#endregion
 //#region src/saml-state.ts
 async function generateRelayState(c, link) {
 	const callbackURL = c.body.callbackURL;
@@ -1996,6 +2228,9 @@ async function generateRelayState(c, link) {
 		errorURL: c.body.errorCallbackURL,
 		newUserURL: c.body.newUserCallbackURL,
 		link,
+		/**
+		* This is the actual expiry time of the state
+		*/
 		expiresAt: Date.now() + 600 * 1e3,
 		requestSignUp: c.body.requestSignUp
 	};
@@ -2016,6 +2251,10 @@ async function parseRelayState(c) {
 	try {
 		parsedData = await parseGenericState(c, state, {
 			cookieName: "relay_state",
+			/**
+			* SAML ACS receives a POST from the IdP, which is typically cross-origin.
+			* SameSite=Lax (default) cookies are not sent on cross-site POST requests.
+			*/
 			skipStateCookieCheck: true
 		});
 	} catch (error) {
@@ -2028,121 +2267,80 @@ async function parseRelayState(c) {
 	if (!parsedData.errorURL) parsedData.errorURL = errorURL;
 	return parsedData;
 }
-const saml = typeof samlifyNamespace.SPMetadata === "function" && typeof samlifyNamespace.setSchemaValidator === "function" ? samlifyNamespace : samlifyDefault ?? samlifyNamespace;
 //#endregion
-//#region src/routes/helpers.ts
-/**
-* Same as `normalizePem`, but applied across the resolved list of IdP signing
-* certificates so multi-cert rotation configs survive the line-trim step.
-*/
-function normalizePemList(certs) {
-	if (!certs) return certs;
-	return certs.map((pem) => normalizePem(pem) ?? pem);
+//#region src/user-resolution.ts
+const SSO_AUTHENTICATION_FAILURE = Symbol("SSO_AUTHENTICATION_FAILURE");
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-async function findSAMLProvider(providerId, options, adapter) {
-	if (options?.defaultSSO?.length) {
-		const match = options.defaultSSO.find((p) => p.providerId === providerId);
-		if (match) return {
-			...match,
-			userId: "default",
-			issuer: match.samlConfig?.issuer || "",
-			...options.domainVerification?.enabled ? { domainVerified: true } : {}
-		};
-	}
-	const res = await adapter.findOne({
-		model: "ssoProvider",
-		where: [{
-			field: "providerId",
-			value: providerId
-		}]
-	});
-	if (!res) return null;
-	return {
-		...res,
-		samlConfig: res.samlConfig ? safeJsonParse(res.samlConfig) || void 0 : void 0
-	};
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.trim().length > 0;
 }
-function createSP(config, baseURL, providerId, opts) {
-	const spData = config.spMetadata;
-	const sloLocation = `${baseURL}/sso/saml2/sp/slo/${providerId}`;
-	const acsUrl = `${baseURL}/sso/saml2/sp/acs/${providerId}`;
-	let metadata = spData?.metadata;
-	if (!metadata) metadata = saml.SPMetadata({
-		entityID: spData?.entityID || config.issuer,
-		assertionConsumerService: [{
-			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-			Location: acsUrl
-		}],
-		singleLogoutService: opts?.sloOptions ? [{
-			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-			Location: sloLocation
-		}, {
-			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
-			Location: sloLocation
-		}] : void 0,
-		wantMessageSigned: config.wantAssertionsSigned || false,
-		authnRequestsSigned: config.authnRequestsSigned || false,
-		nameIDFormat: config.identifierFormat ? [config.identifierFormat] : void 0
-	}).getMetadata() || "";
-	return saml.ServiceProvider({
-		metadata,
-		allowCreate: true,
-		wantLogoutRequestSigned: opts?.sloOptions?.wantLogoutRequestSigned ?? false,
-		wantLogoutResponseSigned: opts?.sloOptions?.wantLogoutResponseSigned ?? false,
-		privateKey: normalizePem(spData?.privateKey || config.privateKey),
-		privateKeyPass: spData?.privateKeyPass,
-		isAssertionEncrypted: spData?.isAssertionEncrypted || false,
-		encPrivateKey: normalizePem(spData?.encPrivateKey),
-		encPrivateKeyPass: spData?.encPrivateKeyPass,
-		relayState: opts?.relayState,
-		clockDrifts: opts?.clockSkew && opts?.clockSkew !== 0 ? [-opts.clockSkew, opts.clockSkew] : void 0
-	});
+function isSSOUserResolution(value) {
+	if (!isRecord(value)) return false;
+	if (value.action === "continue") return true;
+	if (value.action === "link") return isNonEmptyString(value.userId) && (value.profile === "preserve" || value.profile === "update");
+	return value.action === "reject" && isNonEmptyString(value.code) && (value.message === void 0 || typeof value.message === "string");
 }
-function createIdP(config) {
-	const idpData = config.idpMetadata;
-	if (idpData?.metadata) return saml.IdentityProvider({
-		metadata: idpData.metadata,
-		privateKey: normalizePem(idpData.privateKey),
-		privateKeyPass: idpData.privateKeyPass,
-		isAssertionEncrypted: idpData.isAssertionEncrypted,
-		encPrivateKey: normalizePem(idpData.encPrivateKey),
-		encPrivateKeyPass: idpData.encPrivateKeyPass
-	});
-	return saml.IdentityProvider({
-		entityID: idpData?.entityID || config.issuer,
-		singleSignOnService: idpData?.singleSignOnService || [{
-			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
-			Location: config.entryPoint
-		}],
-		singleLogoutService: idpData?.singleLogoutService,
-		signingCert: normalizePemList(resolveSigningCerts(config)),
-		wantAuthnRequestsSigned: config.authnRequestsSigned || false,
-		isAssertionEncrypted: idpData?.isAssertionEncrypted || false,
-		encPrivateKey: normalizePem(idpData?.encPrivateKey),
-		encPrivateKeyPass: idpData?.encPrivateKeyPass
+function logFailure(logger, message, error) {
+	try {
+		logger.error(message, ...error === void 0 ? [] : [error]);
+	} catch {}
+}
+function resolutionFailure() {
+	return new APIError("INTERNAL_SERVER_ERROR", {
+		code: "SSO_USER_RESOLUTION_FAILED",
+		message: "Unable to resolve the SSO user"
 	});
 }
-function escapeHtml(str) {
-	if (!str) return "";
-	return String(str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+async function resolveSSOUser(resolveUser, input, database, logger) {
+	let resolution;
+	try {
+		resolution = await resolveUser(input, { database });
+	} catch (error) {
+		logFailure(logger, "SSO user resolution failed", error);
+		throw resolutionFailure();
+	}
+	if (!isSSOUserResolution(resolution)) {
+		logFailure(logger, "SSO user resolver returned an invalid decision");
+		throw resolutionFailure();
+	}
+	return resolution;
 }
-function isSAMLPostBindingLocation(value) {
-	let url;
+function assertSSOUserResolutionNativeTransactionSupport(adapter) {
+	if (typeof adapter.options?.adapterConfig.transaction === "function") return;
+	throw new APIError("NOT_IMPLEMENTED", {
+		code: "SSO_USER_RESOLUTION_REQUIRES_NATIVE_TRANSACTIONS",
+		message: "SSO user resolution requires a database adapter with native transaction support"
+	});
+}
+async function assertSSOUserResolutionAsyncContextSupport(getStorage = getCurrentDBAdapterAsyncLocalStorage) {
 	try {
-		url = new URL(value);
+		await getStorage();
 	} catch {
-		return false;
+		throw new APIError("NOT_IMPLEMENTED", {
+			code: "SSO_USER_RESOLUTION_REQUIRES_ASYNC_CONTEXT",
+			message: "SSO user resolution requires database transaction async context support"
+		});
 	}
-	return url.protocol === "http:" || url.protocol === "https:";
 }
-function createSAMLPostForm(action, samlParam, samlValue, relayState) {
-	if (!isSAMLPostBindingLocation(action)) throw new APIError("BAD_REQUEST", { message: "SAML POST binding location must be an absolute http or https URL" });
-	const safeAction = escapeHtml(action);
-	const safeSamlParam = escapeHtml(samlParam);
-	const safeSamlValue = escapeHtml(samlValue);
-	const safeRelayState = relayState ? escapeHtml(relayState) : void 0;
-	const html = `<!DOCTYPE html><html><body onload="document.forms[0].submit();"><form method="POST" action="${safeAction}"><input type="hidden" name="${safeSamlParam}" value="${safeSamlValue}" />${safeRelayState ? `<input type="hidden" name="RelayState" value="${safeRelayState}" />` : ""}<noscript><input type="submit" value="Continue" /></noscript></form></body></html>`;
-	return new Response(html, { headers: { "Content-Type": "text/html" } });
+function assertSSOUserResolutionSessionStorage(options) {
+	if (!options.secondaryStorage || options.session?.storeSessionInDatabase === true && options.session.preserveSessionInDatabase !== true) return;
+	throw new APIError("NOT_IMPLEMENTED", {
+		code: "SSO_USER_RESOLUTION_REQUIRES_DATABASE_SESSIONS",
+		message: "SSO user resolution requires database-backed sessions with database fallback"
+	});
+}
+function requireSuccessfulSSOAuthentication(result) {
+	if (!result.error) return result;
+	throw Object.assign(/* @__PURE__ */ new Error("SSO authentication failed"), {
+		[SSO_AUTHENTICATION_FAILURE]: true,
+		result
+	});
+}
+function getFailedSSOAuthenticationResult(error) {
+	if (!(error instanceof Error) || !(SSO_AUTHENTICATION_FAILURE in error) || error[SSO_AUTHENTICATION_FAILURE] !== true || !("result" in error)) return;
+	return error.result;
 }
 //#endregion
 //#region src/saml/timestamp.ts
@@ -2187,42 +2385,43 @@ function validateSAMLTimestamp(conditions, options = {}) {
 }
 //#endregion
 //#region src/routes/saml-pipeline.ts
-/**
-* Validates and returns a safe redirect URL.
-* - Prevents open redirect attacks by validating against trusted origins
-* - Prevents redirect loops by checking if URL points to callback route
-* - Falls back to appOrigin if URL is invalid or unsafe
-*/
-function getSafeRedirectUrl(url, callbackPath, appOrigin, isTrustedOrigin) {
-	if (!url) return appOrigin;
-	if (url.startsWith("/") && !url.startsWith("//")) {
+function getSafeRedirectCandidate(url, callbackPathname, appOrigin, isTrustedOrigin) {
+	if (!url) return;
+	if (url.startsWith("/")) {
+		if (!isSafeSAMLRedirectPath(url)) return;
 		try {
 			const absoluteUrl = new URL(url, appOrigin);
-			if (absoluteUrl.origin !== appOrigin) return appOrigin;
-			const callbackPathname = new URL(callbackPath).pathname;
-			if (absoluteUrl.pathname === callbackPathname) return appOrigin;
+			if (absoluteUrl.origin !== appOrigin || absoluteUrl.pathname === callbackPathname) return;
+			return url;
 		} catch {
-			return appOrigin;
+			return;
 		}
-		return url;
 	}
+	let absoluteUrl;
 	try {
-		const absoluteUrl = new URL(url);
-		if (absoluteUrl.origin === appOrigin) {
-			const callbackPathname = new URL(callbackPath).pathname;
-			if (absoluteUrl.pathname === callbackPathname) return appOrigin;
-			return url;
-		}
-	} catch {}
-	if (!isTrustedOrigin(url, { allowRelativePaths: false })) return appOrigin;
-	try {
-		const callbackPathname = new URL(callbackPath).pathname;
-		if (new URL(url).pathname === callbackPathname) return appOrigin;
+		absoluteUrl = new URL(url);
 	} catch {
-		if (url === callbackPath || url.startsWith(`${callbackPath}?`)) return appOrigin;
+		return;
 	}
+	if (absoluteUrl.origin !== appOrigin && !isTrustedOrigin(url, { allowRelativePaths: false })) return;
+	if (absoluteUrl.origin === appOrigin && absoluteUrl.pathname === callbackPathname) return;
 	return url;
 }
+/**
+* Returns the first safe redirect URL from an ordered list of candidates.
+* - Prevents open redirect attacks by validating against trusted origins
+* - Prevents redirect loops by checking if URL points to callback route
+* - Tries the next candidate when a URL is invalid or unsafe
+* - Falls back to appOrigin when no candidate is safe
+*/
+function getSafeRedirectUrl(candidates, callbackPath, appOrigin, isTrustedOrigin) {
+	const callbackPathname = new URL(callbackPath).pathname;
+	for (const candidate of candidates) {
+		const safeCandidate = getSafeRedirectCandidate(candidate, callbackPathname, appOrigin, isTrustedOrigin);
+		if (safeCandidate) return safeCandidate;
+	}
+	return appOrigin;
+}
 function buildSAMLRedirectUrl(url, params) {
 	const searchParams = new URLSearchParams(params);
 	try {
@@ -2238,6 +2437,14 @@ function buildSAMLRedirectUrl(url, params) {
 		return `${urlWithoutFragment}${urlWithoutFragment.includes("?") ? "&" : "?"}${searchParams.toString()}${fragment}`;
 	}
 }
+function getSAMLRedirectCandidates(relayStateCallbackUrl, samlConfig, samlOptions) {
+	return [
+		relayStateCallbackUrl,
+		samlConfig?.idpInitiatedCallbackUrl,
+		samlOptions?.idpInitiatedCallbackUrl,
+		samlConfig?.callbackUrl
+	];
+}
 function toArray(value) {
 	if (Array.isArray(value)) return value;
 	return value ? [value] : [];
@@ -2304,7 +2511,10 @@ async function processSAMLResponse(ctx, params, options) {
 	if (!parsedSamlConfig) throw new APIError("BAD_REQUEST", { message: "Invalid SAML configuration" });
 	const sp = createSP(parsedSamlConfig, ctx.context.baseURL, providerId, { clockSkew: options?.saml?.clockSkew });
 	const idp = createIdP(parsedSamlConfig);
-	const samlRedirectUrl = getSafeRedirectUrl(relayState?.callbackURL || parsedSamlConfig.callbackUrl, params.currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	const redirectCandidates = getSAMLRedirectCandidates(relayState?.callbackURL, parsedSamlConfig, options?.saml);
+	const samlRedirectUrl = getSafeRedirectUrl(redirectCandidates, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	const samlErrorRedirectUrl = getSafeRedirectUrl([relayState?.errorURL, samlRedirectUrl], currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	params.onErrorRedirectResolved?.(samlErrorRedirectUrl);
 	validateSingleAssertion(SAMLResponse);
 	let parsedResponse;
 	try {
@@ -2349,7 +2559,7 @@ async function processSAMLResponse(ctx, params, options) {
 				expectedAudiences: expectedAudiences.filter(Boolean),
 				expectedRecipients: expectedRecipients.filter(Boolean)
 			});
-			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+			throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 				error: "invalid_saml_response",
 				error_description: error.body?.message || error.message || "Invalid SAML response"
 			}));
@@ -2360,7 +2570,7 @@ async function processSAMLResponse(ctx, params, options) {
 			expectedAudiences: expectedAudiences.filter(Boolean),
 			expectedRecipients: expectedRecipients.filter(Boolean)
 		});
-		throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+		throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 			error: "invalid_saml_response",
 			error_description: "SAML response binding could not be validated"
 		}));
@@ -2372,17 +2582,17 @@ async function processSAMLResponse(ctx, params, options) {
 			enableInResponseToValidation: options?.saml?.enableInResponseToValidation,
 			allowIdpInitiated: options?.saml?.allowIdpInitiated
 		},
-		redirectUrl: samlRedirectUrl
+		redirectUrl: samlErrorRedirectUrl
 	});
 	validateAudience(ctx, {
 		extract,
 		expectedAudience: parsedSamlConfig.audience || sp.entityMeta.getEntityID(),
 		providerId,
-		redirectUrl: samlRedirectUrl
+		redirectUrl: samlErrorRedirectUrl
 	});
+	const issuer = idp.entityMeta.getEntityID();
 	const assertionId = extractAssertionId(samlBindingContent);
 	if (assertionId) {
-		const issuer = idp.entityMeta.getEntityID();
 		const conditions = extract.conditions;
 		const clockSkew = options?.saml?.clockSkew ?? 3e5;
 		const expiresAt = conditions?.notOnOrAfter ? new Date(conditions.notOnOrAfter).getTime() + clockSkew : Date.now() + DEFAULT_ASSERTION_TTL_MS;
@@ -2402,7 +2612,7 @@ async function processSAMLResponse(ctx, params, options) {
 				issuer,
 				providerId
 			});
-			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+			throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 				error: "replay_detected",
 				error_description: "SAML assertion has already been used"
 			}));
@@ -2416,7 +2626,7 @@ async function processSAMLResponse(ctx, params, options) {
 	};
 	const userInfo = {
 		...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, attributes[value]])),
-		id: attr(mapping.id || "nameID") || extract.nameID,
+		id: extract.nameID,
 		email: (attr(mapping.email || "email") || extract.nameID || "").toLowerCase(),
 		name: [attr(mapping.firstName || "givenName"), attr(mapping.lastName || "surname")].filter(Boolean).join(" ") || attr(mapping.name || "displayName") || extract.nameID,
 		emailVerified: options?.trustEmailVerified && mapping.emailVerified ? parseProviderEmailVerified(attr(mapping.emailVerified)) : false
@@ -2431,8 +2641,8 @@ async function processSAMLResponse(ctx, params, options) {
 		throw new APIError("BAD_REQUEST", { message: "Unable to extract user ID or email from SAML response" });
 	}
 	const isTrustedProvider = "domainVerified" in provider && !!provider.domainVerified && validateEmailDomain(userInfo.email, provider.domain);
-	const callbackUrl = relayState?.callbackURL || parsedSamlConfig.callbackUrl || ctx.context.baseURL;
-	const errorUrl = relayState?.errorURL || samlRedirectUrl;
+	const callbackUrl = redirectCandidates.some(Boolean) ? samlRedirectUrl : ctx.context.baseURL;
+	const errorUrl = samlErrorRedirectUrl;
 	let result;
 	try {
 		result = await runWithTransaction(ctx.context.adapter, async () => {
@@ -2446,7 +2656,8 @@ async function processSAMLResponse(ctx, params, options) {
 				},
 				account: {
 					providerId,
-					accountId: userInfo.id,
+					issuer,
+					providerAccountId: userInfo.id,
 					accessToken: "",
 					refreshToken: ""
 				},
@@ -2482,7 +2693,7 @@ async function processSAMLResponse(ctx, params, options) {
 		profile: {
 			providerType: "saml",
 			providerId,
-			accountId: userInfo.id,
+			providerAccountId: userInfo.id,
 			email: userInfo.email,
 			emailVerified: userInfo.emailVerified,
 			rawAttributes: attributes
@@ -2514,7 +2725,7 @@ async function processSAMLResponse(ctx, params, options) {
 			expiresAt: session.expiresAt
 		}).catch((e) => ctx.context.logger.warn("Failed to create SAML session lookup record", e));
 	}
-	return getSafeRedirectUrl(relayState?.callbackURL || parsedSamlConfig.callbackUrl, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	return samlRedirectUrl;
 }
 //#endregion
 //#region src/routes/sso.ts
@@ -2660,10 +2871,6 @@ const registerSSOProvider = (options) => {
 										type: "object",
 										nullable: true,
 										properties: {
-											id: {
-												type: "string",
-												description: "Field mapping for user ID (defaults to 'sub')"
-											},
 											email: {
 												type: "string",
 												description: "Field mapping for email (defaults to 'email')"
@@ -2689,11 +2896,7 @@ const registerSSOProvider = (options) => {
 												description: "Additional field mappings"
 											}
 										},
-										required: [
-											"id",
-											"email",
-											"name"
-										]
+										required: ["email", "name"]
 									}
 								},
 								required: [
@@ -2768,13 +2971,13 @@ const registerSSOProvider = (options) => {
 			if (!member) throw new APIError("BAD_REQUEST", { message: "You are not a member of the organization" });
 			if (ctx.context.hasPlugin("organization") && !hasOrgAdminRole(member)) throw new APIError("FORBIDDEN", { message: "You must be an organization owner or admin to register SSO providers" });
 		}
-		if (new Set([
+		if ((/* @__PURE__ */ new Set([
 			...BUILT_IN_ACCOUNT_PROVIDER_IDS,
 			...Object.keys(ctx.context.options.socialProviders ?? {}),
 			...ctx.context.socialProviders.map((p) => p.id),
 			...ctx.context.trustedProviders,
 			...options?.defaultSSO?.map((p) => p.providerId) ?? []
-		]).has(body.providerId)) {
+		])).has(body.providerId)) {
 			ctx.context.logger.warn(`SSO provider registration rejected for reserved providerId: ${body.providerId}`);
 			throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is reserved and cannot be used for an SSO provider" });
 		}
@@ -2868,6 +3071,7 @@ const registerSSOProvider = (options) => {
 				digestAlgorithm: body.samlConfig.digestAlgorithm
 			}, options?.saml?.algorithms);
 			validateCertSources(body.samlConfig);
+			assertSAMLIdentityProviderAuthority(body.samlConfig);
 			const hasIdpMetadata = body.samlConfig.idpMetadata?.metadata;
 			let hasEntryPoint = false;
 			if (body.samlConfig.entryPoint) try {
@@ -2899,6 +3103,7 @@ const registerSSOProvider = (options) => {
 					cert: body.samlConfig.cert,
 					audience: body.samlConfig.audience,
 					callbackUrl: body.samlConfig.callbackUrl,
+					idpInitiatedCallbackUrl: body.samlConfig.idpInitiatedCallbackUrl,
 					idpMetadata: body.samlConfig.idpMetadata,
 					spMetadata: body.samlConfig.spMetadata,
 					wantAssertionsSigned: body.samlConfig.wantAssertionsSigned,
@@ -3107,7 +3312,7 @@ const signInSSO = (options) => {
 				throw error;
 			}
 			if (!config.authorizationEndpoint) throw new APIError("BAD_REQUEST", { message: "Invalid OIDC configuration. Authorization URL not found." });
-			if (options?.redirectURI?.trim()) await addOAuthServerContext({ ssoProviderId: provider.providerId });
+			await addOAuthServerContext({ [SSO_PROVIDER_STATE_KEY]: await computeSSOProviderReference(provider) });
 			const state = await generateState(ctx);
 			const redirectURI = getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options);
 			const authorizationURL = await createAuthorizationURL({
@@ -3196,13 +3401,14 @@ function getOIDCErrorDescription(error, fallback) {
 * @param stateData - Pre-parsed state data. If not provided, it will be
 *   parsed from the request context.
 */
-async function handleOIDCCallback(ctx, options, providerId, stateData) {
+async function handleOIDCCallback(ctx, options, providerId, stateData, parsedProviderReference) {
 	const { code, error, error_description } = ctx.query;
 	if (!stateData) stateData = await parseState(ctx);
 	if (!stateData) {
 		const errorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
 		throw ctx.redirect(`${errorURL}?error=invalid_state`);
 	}
+	const providerReference = parsedProviderReference ?? parseSSOProviderReference(stateData.serverContext?.["ssoProviderReference"]);
 	const { callbackURL, errorURL, newUserURL, requestSignUp } = stateData;
 	const redirectOIDCError = (error, description) => {
 		const baseURL = errorURL || callbackURL;
@@ -3216,6 +3422,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 	if (!code || error) redirectOIDCError(error || "invalid_request", error_description || (error ? error : "authorization_code_not_found"));
 	const provider = await resolveOIDCProvider(ctx, options, providerId);
 	if (!provider) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=provider not found`);
+	if (!await isCurrentSSOProviderReference(provider, providerReference)) redirectOIDCError("invalid_state", "sso_provider_changed_during_authentication");
 	if (options?.domainVerification?.enabled && !("domainVerified" in provider && provider.domainVerified)) throw new APIError("UNAUTHORIZED", { message: "Provider domain has not been verified" });
 	let config = provider.oidcConfig;
 	if (!config) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=provider not found`);
@@ -3287,7 +3494,28 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 	if (!tokenResponse) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_response_not_found`);
 	let userInfo = null;
 	const mapping = config.mapping || {};
+	const readStringClaim = (claims, claim) => {
+		const value = claims[claim];
+		return typeof value === "string" && value.length > 0 ? value : void 0;
+	};
 	let rawProfile;
+	let verifiedIdToken = null;
+	if (tokenResponse.idToken) {
+		const jwksEndpoint = config.jwksEndpoint;
+		if (!jwksEndpoint) redirectOIDCError("invalid_provider", "jwks_endpoint_not_found");
+		const verified = await validateOIDCIdToken(tokenResponse.idToken, jwksEndpoint, {
+			audience: config.clientId,
+			issuer: provider.issuer
+		}, (url) => ctx.context.isTrustedOrigin(url)).catch((error) => {
+			if (error instanceof DiscoveryError) redirectOIDCError("invalid_provider", error.message);
+			ctx.context.logger.error(error);
+			return null;
+		});
+		if (!verified) redirectOIDCError("invalid_provider", "token_not_verified");
+		if (!readStringClaim(verified.payload, "sub")) redirectOIDCError("invalid_provider", "id_token_subject_missing");
+		verifiedIdToken = verified;
+	}
+	if (options?.resolveUser && !verifiedIdToken) redirectOIDCError("invalid_provider", "id_token_required_for_user_resolution");
 	if (config.userInfoEndpoint) {
 		const userInfoResponse = await fetchOIDCEndpoint("userInfoEndpoint", config.userInfoEndpoint, { headers: { Authorization: `Bearer ${tokenResponse.accessToken}` } }, (url) => ctx.context.isTrustedOrigin(url)).catch((e) => {
 			if (e instanceof DiscoveryError) redirectOIDCError("invalid_provider", e.message);
@@ -3295,58 +3523,83 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		});
 		if (userInfoResponse.error) redirectOIDCError("invalid_provider", userInfoResponse.error.message || userInfoResponse.error.statusText || "userinfo_response_error");
 		const rawUserInfo = userInfoResponse.data ?? redirectOIDCError("invalid_provider", "userinfo_response_not_found");
+		if (verifiedIdToken && rawUserInfo.sub !== verifiedIdToken.payload.sub) redirectOIDCError("invalid_provider", "id_token_userinfo_subject_mismatch");
 		rawProfile = rawUserInfo;
 		userInfo = {
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, rawUserInfo[value]])),
-			id: rawUserInfo[mapping.id || "sub"],
-			email: rawUserInfo[mapping.email || "email"],
+			id: readStringClaim(rawUserInfo, "sub"),
+			email: readStringClaim(rawUserInfo, mapping.email || "email"),
 			emailVerified: options?.trustEmailVerified ? parseProviderEmailVerified(rawUserInfo[mapping.emailVerified || "email_verified"]) : false,
-			name: rawUserInfo[mapping.name || "name"],
-			image: rawUserInfo[mapping.image || "picture"]
+			name: readStringClaim(rawUserInfo, mapping.name || "name"),
+			image: readStringClaim(rawUserInfo, mapping.image || "picture")
 		};
-	} else if (tokenResponse.idToken) {
-		const idToken = decodeJwt(tokenResponse.idToken);
+	} else if (verifiedIdToken) {
+		const idToken = verifiedIdToken.payload;
 		rawProfile = idToken;
-		if (!config.jwksEndpoint) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=jwks_endpoint_not_found`);
-		const verified = await validateOIDCIdToken(tokenResponse.idToken, config.jwksEndpoint, {
-			audience: config.clientId,
-			issuer: provider.issuer
-		}, (url) => ctx.context.isTrustedOrigin(url)).catch((e) => {
-			if (e instanceof DiscoveryError) redirectOIDCError("invalid_provider", e.message);
-			ctx.context.logger.error(e);
-			return null;
-		});
-		if (!verified) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_not_verified`);
 		userInfo = {
-			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, verified.payload[value]])),
-			id: idToken[mapping.id || "sub"],
-			email: idToken[mapping.email || "email"],
+			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, idToken[value]])),
+			id: idToken.sub,
+			email: readStringClaim(idToken, mapping.email || "email"),
 			emailVerified: options?.trustEmailVerified ? parseProviderEmailVerified(idToken[mapping.emailVerified || "email_verified"]) : false,
-			name: idToken[mapping.name || "name"],
-			image: idToken[mapping.image || "picture"]
+			name: readStringClaim(idToken, mapping.name || "name"),
+			image: readStringClaim(idToken, mapping.image || "picture")
 		};
 	} else throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=user_info_endpoint_not_found`);
 	if (!userInfo.email || !userInfo.id) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=missing_user_info`);
 	const userInfoEmail = userInfo.email;
 	const userInfoId = userInfo.id;
+	const providerUser = {
+		...Object.fromEntries(Object.entries(userInfo).filter(([key]) => key !== "id")),
+		email: userInfoEmail,
+		name: typeof userInfo.name === "string" ? userInfo.name : "",
+		image: typeof userInfo.image === "string" ? userInfo.image : void 0,
+		emailVerified: options?.trustEmailVerified ? userInfo.emailVerified === true : false
+	};
+	const accountKey = {
+		issuer: verifiedIdToken && readStringClaim(verifiedIdToken.payload, "iss") || provider.issuer,
+		providerAccountId: userInfoId
+	};
 	const isTrustedProvider = "domainVerified" in provider && provider.domainVerified === true && validateEmailDomain(userInfoEmail, provider.domain);
 	let linked;
 	try {
+		if (options?.resolveUser) {
+			assertSSOUserResolutionNativeTransactionSupport(ctx.context.adapter);
+			assertSSOUserResolutionSessionStorage(ctx.context.options);
+			await assertSSOUserResolutionAsyncContextSupport();
+		}
 		linked = await runWithTransaction(ctx.context.adapter, async () => {
 			await lockSSOProviderForAccountLink(ctx, provider);
-			return handleOAuthUserInfo(ctx, {
+			const currentProvider = await resolveOIDCProvider(ctx, options, providerId, await getCurrentAdapter(ctx.context.adapter));
+			if (!currentProvider || !await isCurrentSSOProviderReference(currentProvider, providerReference)) throw new APIError("CONFLICT", {
+				code: "SSO_PROVIDER_CHANGED",
+				message: "SSO provider changed while account linking was in progress"
+			});
+			const resolution = options?.resolveUser ? await resolveSSOUser(options.resolveUser, {
+				protocol: "oidc",
+				providerId: provider.providerId,
+				accountKey,
+				providerUser,
+				providerClaims: rawProfile ?? {}
+			}, await getCurrentAdapter(ctx.context.adapter), ctx.context.logger) : void 0;
+			if (resolution?.action === "reject") throw new APIError("FORBIDDEN", {
+				code: resolution.code,
+				...resolution.message === void 0 ? {} : { message: resolution.message }
+			});
+			const authentication = await handleOAuthUserInfo(ctx, {
 				userInfo: {
-					email: userInfoEmail,
-					name: userInfo.name || "",
+					...providerUser,
+					email: providerUser.email,
+					name: providerUser.name,
 					id: userInfoId,
-					image: userInfo.image,
-					emailVerified: options?.trustEmailVerified ? userInfo.emailVerified || false : false
+					image: providerUser.image,
+					emailVerified: providerUser.emailVerified
 				},
 				account: {
 					idToken: tokenResponse.idToken,
 					accessToken: tokenResponse.accessToken,
 					refreshToken: tokenResponse.refreshToken,
-					accountId: userInfoId,
+					issuer: accountKey.issuer,
+					providerAccountId: userInfoId,
 					providerId: provider.providerId,
 					accessTokenExpiresAt: tokenResponse.accessTokenExpiresAt,
 					refreshTokenExpiresAt: tokenResponse.refreshTokenExpiresAt,
@@ -3363,18 +3616,28 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 					}
 				},
 				isTrustedProvider,
-				trustProviderByName: false
+				trustProviderByName: false,
+				selectedUser: resolution?.action === "link" ? {
+					userId: resolution.userId,
+					profile: resolution.profile
+				} : void 0,
+				deferNonDatabaseWrites: !!options?.resolveUser,
+				requireExactAccountBinding: !!options?.resolveUser
 			});
-		});
+			return options?.resolveUser ? requireSuccessfulSSOAuthentication(authentication) : authentication;
+		}, { onAfterCommitHookError(error) {
+			ctx.context.logger.error("Committed SSO authentication after-hook failed", error);
+		} });
 	} catch (e) {
-		if (isAPIError(e) && e.body?.code) {
+		const failedAuthentication = getFailedSSOAuthenticationResult(e);
+		if (failedAuthentication) linked = failedAuthentication;
+		else if (isAPIError(e) && e.body?.code) {
 			const baseURL = errorURL || callbackURL;
 			const params = new URLSearchParams({ error: e.body.code });
 			if (e.body.message) params.set("error_description", e.body.message);
 			const sep = baseURL.includes("?") ? "&" : "?";
 			throw ctx.redirect(`${baseURL}${sep}${params.toString()}`);
-		}
-		throw e;
+		} else throw e;
 	}
 	if (linked.error) {
 		const baseURL = errorURL || callbackURL;
@@ -3394,7 +3657,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		profile: {
 			providerType: "oidc",
 			providerId: provider.providerId,
-			accountId: userInfoId,
+			providerAccountId: userInfoId,
 			email: userInfoEmail,
 			emailVerified: Boolean(userInfo.emailVerified),
 			rawAttributes: userInfo
@@ -3403,6 +3666,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		token: tokenResponse,
 		provisioningOptions: options?.organizationProvisioning
 	});
+	if ("accountCookie" in linked && linked.accountCookie) await setAccountCookie(ctx, linked.accountCookie);
 	await setSessionCookie(ctx, {
 		session,
 		user
@@ -3434,7 +3698,7 @@ const callbackSSOEndpointConfig = {
 * and falling back to the `ssoProvider` table. Returns `null` when no match is
 * found so the caller can decide how to react (redirect, silently skip, etc.).
 */
-async function resolveOIDCProvider(ctx, options, providerId) {
+async function resolveOIDCProvider(ctx, options, providerId, adapter = ctx.context.adapter) {
 	const matchingDefault = options?.defaultSSO?.find((defaultProvider) => defaultProvider.providerId === providerId);
 	if (matchingDefault) return {
 		...matchingDefault,
@@ -3442,7 +3706,7 @@ async function resolveOIDCProvider(ctx, options, providerId) {
 		userId: "default",
 		...options?.domainVerification?.enabled ? { domainVerified: true } : {}
 	};
-	return ctx.context.adapter.findOne({
+	return adapter.findOne({
 		model: "ssoProvider",
 		where: [{
 			field: "providerId",
@@ -3482,7 +3746,7 @@ async function bounceIfIdpInitiated(ctx, options, providerId) {
 		});
 		return;
 	}
-	if (options?.redirectURI?.trim()) await addOAuthServerContext({ ssoProviderId: provider.providerId });
+	await addOAuthServerContext({ [SSO_PROVIDER_STATE_KEY]: await computeSSOProviderReference(provider) });
 	const state = await generateState(ctx);
 	const redirectURI = getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options);
 	const authorizationURL = await createAuthorizationURL({
@@ -3534,12 +3798,12 @@ const callbackSSOShared = (options) => {
 			const errorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
 			throw ctx.redirect(`${errorURL}?error=invalid_state`);
 		}
-		const providerId = stateData.serverContext?.ssoProviderId;
-		if (!providerId) {
+		const providerReference = parseSSOProviderReference(stateData.serverContext?.[SSO_PROVIDER_STATE_KEY]);
+		if (!providerReference) {
 			const errorURL = stateData.errorURL || stateData.callbackURL;
-			throw ctx.redirect(`${errorURL}?error=invalid_state&error_description=missing_provider_id`);
+			throw ctx.redirect(`${errorURL}?error=invalid_state&error_description=missing_sso_provider_reference`);
 		}
-		return handleOIDCCallback(ctx, options, providerId, stateData);
+		return handleOIDCCallback(ctx, options, providerReference.providerId, stateData, providerReference);
 	});
 };
 const acsEndpointBodySchema = z.object({
@@ -3569,13 +3833,14 @@ const acsEndpoint = (options) => {
 		const { providerId } = ctx.params;
 		const currentCallbackPath = `${ctx.context.baseURL}/sso/saml2/sp/acs/${providerId}`;
 		const appOrigin = new URL(ctx.context.baseURL).origin;
+		let resolvedErrorRedirectUrl;
 		if (ctx.method === "GET" && !ctx.body?.SAMLResponse) {
 			if (!(await getSessionFromCtx(ctx))?.session) {
 				const errorURL = ctx.context.options.onAPIError?.errorURL || `${appOrigin}/error`;
 				throw ctx.redirect(`${errorURL}?error=invalid_request`);
 			}
 			const relayState = ctx.query?.RelayState;
-			throw ctx.redirect(getSafeRedirectUrl(relayState, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings)));
+			throw ctx.redirect(getSafeRedirectUrl([relayState], currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings)));
 		}
 		if (!ctx.body?.SAMLResponse) throw new APIError("BAD_REQUEST", { message: "SAMLResponse is required for POST requests" });
 		try {
@@ -3583,15 +3848,33 @@ const acsEndpoint = (options) => {
 				SAMLResponse: ctx.body.SAMLResponse,
 				RelayState: ctx.body.RelayState,
 				providerId,
-				currentCallbackPath
+				currentCallbackPath,
+				onErrorRedirectResolved: (url) => {
+					resolvedErrorRedirectUrl = url;
+				}
 			}, options);
 			throw ctx.redirect(safeRedirectUrl);
 		} catch (error) {
 			if (error instanceof Response || error && typeof error === "object" && "status" in error && error.status === 302) throw error;
 			if (error instanceof APIError && error.statusCode === 400) {
 				const errorCode = (error.body?.code || "saml_error").toLowerCase();
-				const redirectUrl = getSafeRedirectUrl(ctx.body?.RelayState || void 0, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
-				throw ctx.redirect(`${redirectUrl}${redirectUrl.includes("?") ? "&" : "?"}error=${encodeURIComponent(errorCode)}&error_description=${encodeURIComponent(error.message)}`);
+				let redirectUrl = resolvedErrorRedirectUrl;
+				if (!redirectUrl) {
+					let parsedSamlConfig;
+					try {
+						parsedSamlConfig = (await findSAMLProvider(providerId, options, ctx.context.adapter))?.samlConfig;
+					} catch (providerLookupError) {
+						ctx.context.logger.warn("Failed to resolve SAML provider for error redirect", {
+							providerId,
+							error: providerLookupError
+						});
+					}
+					redirectUrl = getSafeRedirectUrl(getSAMLRedirectCandidates(void 0, parsedSamlConfig, options?.saml), currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+				}
+				throw ctx.redirect(buildSAMLRedirectUrl(redirectUrl, {
+					error: errorCode,
+					error_description: error.message
+				}));
 			}
 			throw error;
 		}
@@ -3620,7 +3903,7 @@ const sloEndpoint = (options) => {
 		const samlResponse = ctx.body?.SAMLResponse || ctx.query?.SAMLResponse;
 		const relayState = ctx.body?.RelayState || ctx.query?.RelayState;
 		const appOrigin = new URL(ctx.context.baseURL).origin;
-		const safeErrorURL = getSafeRedirectUrl(relayState, `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+		const safeErrorURL = getSafeRedirectUrl([relayState], `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 		if (!samlRequest && !samlResponse) throw ctx.redirect(`${safeErrorURL}?error=invalid_request&error_description=missing_logout_data`);
 		const provider = await findSAMLProvider(providerId, options, ctx.context.adapter);
 		if (!provider?.samlConfig) throw APIError.from("NOT_FOUND", SAML_ERROR_CODES.SAML_PROVIDER_NOT_FOUND);
@@ -3660,7 +3943,7 @@ async function handleLogoutResponse(ctx, sp, idp, relayState, providerId) {
 	}
 	deleteSessionCookie(ctx);
 	const appOrigin = new URL(ctx.context.baseURL).origin;
-	const safeRedirectUrl = getSafeRedirectUrl(relayState, `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	const safeRedirectUrl = getSafeRedirectUrl([relayState], `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 	throw ctx.redirect(safeRedirectUrl);
 }
 async function handleLogoutRequest(ctx, sp, idp, relayState, providerId) {