@better-auth/sso 1.7.0-rc.1 → 1.7.0-rc.3

package/dist/index.mjs

@@ -1,24 +1,26 @@
-import { t as PACKAGE_VERSION } from "./version-lPD-GbqS.mjs";
+import { t as PACKAGE_VERSION } from "./version-xoFrTW0m.mjs";
 import { APIError, addOAuthServerContext, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { XMLParser, XMLValidator } from "fast-xml-parser";
 import { X509Certificate } from "node:crypto";
 import { getHostname } from "tldts";
 import { generateRandomString } from "better-auth/crypto";
 import * as z from "zod";
-import { getCurrentAdapter, runWithTransaction } from "@better-auth/core/context";
+import { getCurrentAdapter, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { filterOutputFields } from "@better-auth/core/utils/db";
 import { classifyHost, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { betterFetch } from "@better-fetch/fetch";
-import { createRemoteJWKSet, customFetch, decodeJwt, jwtVerify } from "jose";
-import { base64 } from "@better-auth/utils/base64";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
+import { base64, base64Url } from "@better-auth/utils/base64";
+import { createHash } from "@better-auth/utils/hash";
+import { DOMParser } from "@xmldom/xmldom";
+import * as samlifyNamespace from "samlify";
+import samlifyDefault from "samlify";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
 import { parseInputData, toZodSchema } from "better-auth/db";
 import { isAPIError } from "@better-auth/core/utils/is-api-error";
 import { HIDE_METADATA, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, authorizationCodeRequest, createAuthorizationURL, createPrivateKeyJwtClientAssertionGetter, generateGenericState, generateState, getOAuth2Tokens, parseGenericState, parseState } from "better-auth";
-import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
+import { deleteSessionCookie, setAccountCookie, setSessionCookie } from "better-auth/cookies";
 import { additionalAuthorizationParamsSchema, handleOAuthUserInfo } from "better-auth/oauth2";
-import * as samlifyNamespace from "samlify";
-import samlifyDefault from "samlify";
 //#region src/constants.ts
 /**
 * SAML Constants
@@ -60,6 +62,8 @@ const DEFAULT_MAX_SAML_RESPONSE_SIZE = 256 * 1024;
 const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;
 //#endregion
 //#region src/utils.ts
+const unsafeSAMLRedirectPathPrefix = /^\/(?:\/|\\|%2f|%5c)/i;
+const isSafeSAMLRedirectPath = (url) => url.startsWith("/") && !unsafeSAMLRedirectPathPrefix.test(url);
 /**
 * Safely parses a value that might be a JSON string or already a parsed object.
 * This handles cases where ORMs like Drizzle might return already parsed objects
@@ -515,15 +519,21 @@ async function fetchOIDCEndpointResponse(name, endpoint, init, isTrustedOrigin)
 	if (isHttpRedirectStatus(response.status)) throwRedirectError(name, endpoint, response.status, response.headers.get("location"));
 	return response;
 }
+/** Enforces the OpenID Connect authorized-party rules for ID Tokens. */
+function assertOIDCAuthorizedParty(payload, clientId) {
+	if (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp === void 0 || payload.azp !== void 0 && payload.azp !== clientId) throw new Error("OIDC ID token authorized party does not match the client");
+}
 /**
 * Validate an OIDC ID token using the same endpoint fetch policy as the rest of
 * the SSO OIDC flow.
 */
 async function validateOIDCIdToken(token, jwksEndpoint, options, isTrustedOrigin) {
-	return jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: (url, init) => fetchOIDCEndpointResponse("jwksEndpoint", url, init, isTrustedOrigin) }), {
+	const verified = await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: (url, init) => fetchOIDCEndpointResponse("jwksEndpoint", url, init, isTrustedOrigin) }), {
 		audience: options.audience,
 		issuer: options.issuer
 	});
+	if (typeof options.audience === "string") assertOIDCAuthorizedParty(verified.payload, options.audience);
+	return verified;
 }
 /**
 * Fetch the OIDC discovery document from the IdP.
@@ -808,6 +818,102 @@ function mapDiscoveryErrorToAPIError(error) {
 	}
 }
 //#endregion
+//#region src/provider-reference.ts
+const SSO_PROVIDER_STATE_KEY = "ssoProviderReference";
+function serializeCanonical(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return `[${value.map((entry) => entry === void 0 ? "null" : serializeCanonical(entry)).join(",")}]`;
+	switch (typeof value) {
+		case "boolean":
+		case "number":
+		case "string": return JSON.stringify(value);
+		case "object": return `{${Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${serializeCanonical(entry)}`).join(",")}}`;
+		default: throw new TypeError("SSO provider configuration must be JSON-serializable");
+	}
+}
+function withoutOIDCSecret(configuration) {
+	if (!configuration) return void 0;
+	const result = { ...configuration };
+	result.clientSecret = void 0;
+	return result;
+}
+function withoutSAMLPrivateKeys(configuration) {
+	if (!configuration) return void 0;
+	return {
+		...configuration,
+		privateKey: void 0,
+		idpMetadata: {
+			...configuration.idpMetadata,
+			privateKey: void 0,
+			privateKeyPass: void 0,
+			encPrivateKey: void 0,
+			encPrivateKeyPass: void 0
+		},
+		spMetadata: configuration.spMetadata ? {
+			...configuration.spMetadata,
+			privateKey: void 0,
+			privateKeyPass: void 0,
+			encPrivateKey: void 0,
+			encPrivateKeyPass: void 0
+		} : void 0
+	};
+}
+function getProviderSource(provider) {
+	return typeof provider.id === "string" && provider.id.length > 0 ? {
+		type: "persisted",
+		recordId: provider.id
+	} : { type: "configured" };
+}
+async function computeProviderAuthenticationFingerprint(provider) {
+	const digest = await createHash("SHA-256").digest(serializeCanonical({
+		domain: provider.domain,
+		domainVerified: "domainVerified" in provider ? provider.domainVerified : void 0,
+		issuer: provider.issuer,
+		organizationId: provider.organizationId,
+		oidcConfig: withoutOIDCSecret(provider.oidcConfig),
+		samlConfig: withoutSAMLPrivateKeys(provider.samlConfig)
+	}));
+	return base64Url.encode(new Uint8Array(digest), { padding: false });
+}
+async function computeSSOProviderReference(provider) {
+	return {
+		providerId: provider.providerId,
+		source: getProviderSource(provider),
+		authenticationConfigurationFingerprint: await computeProviderAuthenticationFingerprint(provider)
+	};
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseSSOProviderReference(value) {
+	if (!isRecord$2(value) || !isRecord$2(value.source)) return null;
+	const providerId = value.providerId;
+	const authenticationConfigurationFingerprint = value.authenticationConfigurationFingerprint;
+	const source = value.source;
+	if (typeof providerId !== "string" || providerId.length === 0 || typeof authenticationConfigurationFingerprint !== "string" || authenticationConfigurationFingerprint.length === 0) return null;
+	if (source.type === "configured") return {
+		providerId,
+		source: { type: "configured" },
+		authenticationConfigurationFingerprint
+	};
+	if (source.type === "persisted" && typeof source.recordId === "string" && source.recordId.length > 0) return {
+		providerId,
+		source: {
+			type: "persisted",
+			recordId: source.recordId
+		},
+		authenticationConfigurationFingerprint
+	};
+	return null;
+}
+async function isCurrentSSOProviderReference(provider, reference) {
+	if (!reference || reference.providerId !== provider.providerId) return false;
+	const source = getProviderSource(provider);
+	if (source.type !== reference.source.type) return false;
+	if (source.type === "persisted" && (reference.source.type !== "persisted" || source.recordId !== reference.source.recordId)) return false;
+	return reference.authenticationConfigurationFingerprint === await computeProviderAuthenticationFingerprint(provider);
+}
+//#endregion
 //#region src/saml/parser.ts
 const xmlParser = new XMLParser({
 	ignoreAttributes: false,
@@ -1021,8 +1127,12 @@ function validateConfigAlgorithms(config, options = {}) {
 		});
 	}
 }
+const saml = typeof samlifyNamespace.SPMetadata === "function" && typeof samlifyNamespace.setSchemaValidator === "function" ? samlifyNamespace : samlifyDefault ?? samlifyNamespace;
 //#endregion
 //#region src/saml/assertions.ts
+const SAML_ASSERTION_NAMESPACE = "urn:oasis:names:tc:SAML:2.0:assertion";
+const SAML_PROTOCOL_NAMESPACE = "urn:oasis:names:tc:SAML:2.0:protocol";
+const XML_SIGNATURE_NAMESPACE = "http://www.w3.org/2000/09/xmldsig#";
 function countAssertions(xml) {
 	let parsed;
 	try {
@@ -1062,6 +1172,39 @@ function validateSingleAssertion(samlResponse) {
 		code: "SAML_MULTIPLE_ASSERTIONS"
 	});
 }
+function assertionSignatureFailure() {
+	return new APIError("BAD_REQUEST", {
+		code: "SAML_ASSERTION_SIGNATURE_REQUIRED",
+		message: "SAML assertion signature is required"
+	});
+}
+/**
+* Verifies that the sole plaintext SAML Assertion, rather than only its
+* enclosing Response, is authenticated by an XML signature from the IdP.
+*/
+function verifySAMLAssertionSignature(samlContent, verificationOptions) {
+	try {
+		const document = new DOMParser({ onError: (_level, message) => {
+			throw new Error(message);
+		} }).parseFromString(samlContent, "text/xml");
+		const response = document.documentElement;
+		if (!response || response.localName !== "Response" || response.namespaceURI !== SAML_PROTOCOL_NAMESPACE) throw assertionSignatureFailure();
+		const assertionElements = Array.from(response.childNodes).filter((node) => node.nodeType === 1 && node.localName === "Assertion" && node.namespaceURI === SAML_ASSERTION_NAMESPACE);
+		const assertion = assertionElements.at(0);
+		if (assertionElements.length !== 1 || !assertion) throw assertionSignatureFailure();
+		if (Array.from(assertion.childNodes).filter((node) => node.nodeType === 1 && node.localName === "Signature" && node.namespaceURI === XML_SIGNATURE_NAMESPACE).length !== 1) throw assertionSignatureFailure();
+		for (const node of Array.from(response.childNodes)) if (node.nodeType === 1 && node.localName === "Signature") response.removeChild(node);
+		const assertionId = assertion.getAttribute("ID");
+		if (!assertionId) throw assertionSignatureFailure();
+		const [verified, authenticatedAssertion] = saml.SamlLib.verifySignature(document.toString(), verificationOptions);
+		if (!verified || !authenticatedAssertion) throw assertionSignatureFailure();
+		const authenticatedRoot = new DOMParser().parseFromString(authenticatedAssertion, "text/xml").documentElement;
+		if (!authenticatedRoot || authenticatedRoot.localName !== "Assertion" || authenticatedRoot.namespaceURI !== SAML_ASSERTION_NAMESPACE || authenticatedRoot.getAttribute("ID") !== assertionId) throw assertionSignatureFailure();
+	} catch (error) {
+		if (error instanceof APIError && error.body?.code === "SAML_ASSERTION_SIGNATURE_REQUIRED") throw error;
+		throw assertionSignatureFailure();
+	}
+}
 //#endregion
 //#region src/saml/error-codes.ts
 const SAML_ERROR_CODES = defineErrorCodes({
@@ -1107,6 +1250,7 @@ function validateCertSources(config) {
 //#region src/saml/response-binding.ts
 const SAML_HTTP_POST_BINDING = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
 const SAML_BEARER_CONFIRMATION_METHOD = "urn:oasis:names:tc:SAML:2.0:cm:bearer";
+const SAML_METADATA_NAMESPACE = "urn:oasis:names:tc:SAML:2.0:metadata";
 function toNode(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
 	return value;
@@ -1138,11 +1282,75 @@ function parseSAMLContent(samlContent) {
 		code: "SAML_RESPONSE_INVALID_XML"
 	});
 }
+function directMetadataChildren(element, localName) {
+	return Array.from(element.childNodes).filter((node) => node.nodeType === 1 && node.localName === localName && node.namespaceURI === SAML_METADATA_NAMESPACE);
+}
+function parseXMLSchemaBoolean(value) {
+	if (value === null) return false;
+	switch (value.trim()) {
+		case "true":
+		case "1": return true;
+		case "false":
+		case "0": return false;
+		default: throw new Error("Invalid XML Schema boolean");
+	}
+}
+function isAbsoluteHttpUrl(value) {
+	if (value.includes("#")) return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* Parses the security- and identity-relevant parts of SAML service-provider
+* metadata without relying on local-name-only XML matching.
+*/
+function parseSAMLServiceProviderMetadata(metadata) {
+	const document = new DOMParser({ onError: (_level, message) => {
+		throw new Error(message);
+	} }).parseFromString(metadata, "text/xml");
+	const entityDescriptor = document.documentElement;
+	if (!entityDescriptor || entityDescriptor.localName !== "EntityDescriptor" || entityDescriptor.namespaceURI !== SAML_METADATA_NAMESPACE) throw new Error("Invalid SAML EntityDescriptor");
+	const entityID = entityDescriptor.getAttribute("entityID")?.trim();
+	if (!entityID) throw new Error("Missing SAML entityID");
+	const serviceProviderDescriptors = directMetadataChildren(entityDescriptor, "SPSSODescriptor");
+	if (serviceProviderDescriptors.length === 0) throw new Error("SAML metadata must contain an SPSSODescriptor");
+	const acceptedServiceProviderDescriptors = new Set(serviceProviderDescriptors);
+	for (const element of Array.from(document.getElementsByTagName("*"))) {
+		if (element.localName === "EntityDescriptor" && element !== entityDescriptor) throw new Error("Invalid nested SAML EntityDescriptor");
+		if (element.localName === "SPSSODescriptor" && !acceptedServiceProviderDescriptors.has(element)) throw new Error("Invalid SAML SPSSODescriptor namespace or position");
+		if ((element.localName === "AssertionConsumerService" || element.localName === "NameIDFormat") && (element.namespaceURI !== SAML_METADATA_NAMESPACE || !element.parentNode || !acceptedServiceProviderDescriptors.has(element.parentNode))) throw new Error(`Invalid SAML ${element.localName} namespace or position`);
+	}
+	const postAssertionConsumerServiceUrls = [];
+	const nameIDFormats = [];
+	let wantAssertionsSigned = false;
+	for (const descriptor of serviceProviderDescriptors) {
+		wantAssertionsSigned = parseXMLSchemaBoolean(descriptor.getAttribute("WantAssertionsSigned")) || wantAssertionsSigned;
+		for (const nameIDFormat of directMetadataChildren(descriptor, "NameIDFormat")) {
+			const value = nameIDFormat.textContent?.trim();
+			if (value) nameIDFormats.push(value);
+		}
+		for (const service of directMetadataChildren(descriptor, "AssertionConsumerService")) {
+			if (service.getAttribute("Binding") !== "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST") continue;
+			const location = service.getAttribute("Location")?.trim();
+			if (!location || !isAbsoluteHttpUrl(location)) throw new Error("Invalid SAML POST AssertionConsumerService");
+			postAssertionConsumerServiceUrls.push(location);
+		}
+	}
+	return {
+		entityID,
+		nameIDFormats: [...new Set(nameIDFormats)],
+		postAssertionConsumerServiceUrls: [...new Set(postAssertionConsumerServiceUrls)],
+		wantAssertionsSigned
+	};
+}
 function getSAMLPostAssertionConsumerServiceUrls(metadata) {
 	if (!metadata) return [];
 	try {
-		const locations = toNodeArray(findNode(toNode(xmlParser.parse(metadata)), "SPSSODescriptor")).flatMap((descriptor) => toNodeArray(descriptor.AssertionConsumerService).filter((service) => service["@_Binding"] === SAML_HTTP_POST_BINDING).map((service) => service["@_Location"]).filter((location) => typeof location === "string" && !!location));
-		return [...new Set(locations)];
+		return parseSAMLServiceProviderMetadata(metadata).postAssertionConsumerServiceUrls;
 	} catch {
 		return [];
 	}
@@ -1242,7 +1450,7 @@ function errorRedirectUrl(base, error, description) {
 * samlify's parsed output (not at the top level).
 */
 async function validateInResponseTo(c, ctx) {
-	if (ctx.options.enableInResponseToValidation === false) return;
+	if (ctx.options.enableInResponseToValidation === false) return null;
 	const inResponseTo = ctx.extract.response?.inResponseTo;
 	const allowIdpInitiated = ctx.options.allowIdpInitiated ?? false;
 	if (inResponseTo) {
@@ -1268,10 +1476,23 @@ async function validateInResponseTo(c, ctx) {
 			});
 			throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_saml_response", "Provider mismatch"));
 		}
+		const providerReference = parseSSOProviderReference(storedRequest.providerReference);
+		if (!providerReference) {
+			c.context.logger.error("SAML InResponseTo validation failed: provider reference missing or invalid", {
+				inResponseTo,
+				providerId: ctx.providerId
+			});
+			throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "invalid_state", "SSO provider reference missing or invalid"));
+		}
+		return {
+			...storedRequest,
+			providerReference
+		};
 	} else if (!allowIdpInitiated) {
 		c.context.logger.error("SAML IdP-initiated SSO rejected: InResponseTo missing and allowIdpInitiated is false", { providerId: ctx.providerId });
 		throw c.redirect(errorRedirectUrl(ctx.redirectUrl, "unsolicited_response", "IdP-initiated SSO not allowed"));
 	}
+	return null;
 }
 /**
 * Validates the AudienceRestriction of a SAML assertion.
@@ -1302,7 +1523,260 @@ function validateAudience(c, ctx) {
 	}
 }
 //#endregion
+//#region src/user-resolution.ts
+const SSO_AUTHENTICATION_FAILURE = Symbol("SSO_AUTHENTICATION_FAILURE");
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.trim().length > 0;
+}
+function isSSOUserResolution(value) {
+	if (!isRecord$1(value)) return false;
+	if (value.action === "continue") return true;
+	if (value.action === "link") return isNonEmptyString(value.userId) && (value.profile === "preserve" || value.profile === "update");
+	return value.action === "reject" && isNonEmptyString(value.code) && (value.message === void 0 || typeof value.message === "string");
+}
+function logFailure(logger, message) {
+	try {
+		logger.error(message);
+	} catch {}
+}
+function resolutionFailure() {
+	return new APIError("INTERNAL_SERVER_ERROR", {
+		code: "SSO_USER_RESOLUTION_FAILED",
+		message: "Unable to resolve the SSO user"
+	});
+}
+async function resolveSSOUser(resolveUser, input, database, logger) {
+	let resolution;
+	try {
+		resolution = await resolveUser(input, { database });
+	} catch {
+		logFailure(logger, "SSO user resolution failed");
+		throw resolutionFailure();
+	}
+	if (!isSSOUserResolution(resolution)) {
+		logFailure(logger, "SSO user resolver returned an invalid decision");
+		throw resolutionFailure();
+	}
+	return resolution;
+}
+function assertSSOUserResolutionNativeTransactionSupport(adapter) {
+	assertSSONativeTransactionSupport(adapter, {
+		code: "SSO_USER_RESOLUTION_REQUIRES_NATIVE_TRANSACTIONS",
+		message: "SSO user resolution requires a database adapter with native transaction support"
+	});
+}
+function assertSSONativeTransactionSupport(adapter, error) {
+	if (typeof adapter.options?.adapterConfig.transaction === "function") return;
+	throw new APIError("NOT_IMPLEMENTED", {
+		code: error.code,
+		message: error.message
+	});
+}
+async function assertSSOUserResolutionAsyncContextSupport(getStorage = getCurrentDBAdapterAsyncLocalStorage) {
+	await assertSSOAsyncContextSupport({
+		code: "SSO_USER_RESOLUTION_REQUIRES_ASYNC_CONTEXT",
+		message: "SSO user resolution requires database transaction async context support"
+	}, getStorage);
+}
+async function assertSSOAsyncContextSupport(error, getStorage = getCurrentDBAdapterAsyncLocalStorage) {
+	try {
+		await getStorage();
+	} catch {
+		throw new APIError("NOT_IMPLEMENTED", {
+			code: error.code,
+			message: error.message
+		});
+	}
+}
+function assertSSOUserResolutionSessionStorage(options) {
+	if (!options.secondaryStorage || options.session?.storeSessionInDatabase === true && options.session.preserveSessionInDatabase !== true) return;
+	throw new APIError("NOT_IMPLEMENTED", {
+		code: "SSO_USER_RESOLUTION_REQUIRES_DATABASE_SESSIONS",
+		message: "SSO user resolution requires database-backed sessions with database fallback"
+	});
+}
+function requireSuccessfulSSOAuthentication(result) {
+	if (!result.error) return result;
+	throw Object.assign(/* @__PURE__ */ new Error("SSO authentication failed"), {
+		[SSO_AUTHENTICATION_FAILURE]: true,
+		result
+	});
+}
+function getFailedSSOAuthenticationResult(error) {
+	if (!(error instanceof Error) || !(SSO_AUTHENTICATION_FAILURE in error) || error[SSO_AUTHENTICATION_FAILURE] !== true || !("result" in error)) return;
+	return error.result;
+}
+//#endregion
+//#region src/routes/helpers.ts
+/**
+* Same as `normalizePem`, but applied across the resolved list of IdP signing
+* certificates so multi-cert rotation configs survive the line-trim step.
+*/
+function normalizePemList(certs) {
+	if (!certs) return certs;
+	return certs.map((pem) => normalizePem(pem) ?? pem);
+}
+async function findSAMLProvider(providerId, options, adapter) {
+	if (options?.defaultSSO?.length) {
+		const match = options.defaultSSO.find((p) => p.providerId === providerId);
+		if (match) return {
+			...match,
+			userId: "default",
+			issuer: match.samlConfig?.issuer || "",
+			...options.domainVerification?.enabled ? { domainVerified: true } : {}
+		};
+	}
+	const res = await adapter.findOne({
+		model: "ssoProvider",
+		where: [{
+			field: "providerId",
+			value: providerId
+		}]
+	});
+	if (!res) return null;
+	return {
+		...res,
+		samlConfig: res.samlConfig ? safeJsonParse(res.samlConfig) || void 0 : void 0
+	};
+}
+function createSP(config, baseURL, providerId, opts) {
+	const spData = config.spMetadata;
+	const sloLocation = `${baseURL}/sso/saml2/sp/slo/${providerId}`;
+	const acsUrl = `${baseURL}/sso/saml2/sp/acs/${providerId}`;
+	let metadata = spData?.metadata;
+	assertSAMLServiceProviderMetadataPolicy(config);
+	if (!metadata) metadata = saml.SPMetadata({
+		entityID: spData?.entityID || config.issuer,
+		assertionConsumerService: [{
+			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+			Location: acsUrl
+		}],
+		singleLogoutService: opts?.sloOptions ? [{
+			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+			Location: sloLocation
+		}, {
+			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
+			Location: sloLocation
+		}] : void 0,
+		wantAssertionsSigned: config.wantAssertionsSigned || false,
+		authnRequestsSigned: config.authnRequestsSigned || false,
+		nameIDFormat: config.identifierFormat ? [config.identifierFormat] : void 0
+	}).getMetadata() || "";
+	return saml.ServiceProvider({
+		metadata,
+		allowCreate: true,
+		wantLogoutRequestSigned: opts?.sloOptions?.wantLogoutRequestSigned ?? false,
+		wantLogoutResponseSigned: opts?.sloOptions?.wantLogoutResponseSigned ?? false,
+		privateKey: normalizePem(spData?.privateKey || config.privateKey),
+		privateKeyPass: spData?.privateKeyPass,
+		isAssertionEncrypted: spData?.isAssertionEncrypted || false,
+		encPrivateKey: normalizePem(spData?.encPrivateKey),
+		encPrivateKeyPass: spData?.encPrivateKeyPass,
+		relayState: opts?.relayState,
+		clockDrifts: opts?.clockSkew && opts?.clockSkew !== 0 ? [-opts.clockSkew, opts.clockSkew] : void 0
+	});
+}
+/**
+* Ensures custom SP metadata cannot weaken the configured assertion-signing
+* policy. This is safe to call before persisting a provider configuration.
+*/
+function assertSAMLServiceProviderMetadataPolicy(config) {
+	const policy = deriveSAMLServiceProviderPolicy(config);
+	if (config.wantAssertionsSigned !== true || policy.wantAssertionsSigned) return;
+	throw new APIError("BAD_REQUEST", {
+		code: "SAML_SP_METADATA_ASSERTION_SIGNATURE_MISMATCH",
+		message: "SAML service provider metadata must require signed assertions"
+	});
+}
+function assertSAMLMetadataSize(metadata, kind, maxMetadataSize) {
+	if (metadata && new TextEncoder().encode(metadata).length > maxMetadataSize) throw new APIError("BAD_REQUEST", { message: `${kind} metadata exceeds maximum allowed size (${maxMetadataSize} bytes)` });
+}
+/**
+* Parses custom SP metadata and returns its effective verification policy.
+*
+* Configurations without custom metadata use the code-defined policy directly.
+* Invalid or unusable custom metadata throws an API error with the
+* `SAML_INVALID_SP_METADATA` code.
+*/
+function deriveSAMLServiceProviderPolicy(config) {
+	const metadata = config.spMetadata?.metadata;
+	if (!metadata) return { wantAssertionsSigned: config.wantAssertionsSigned === true };
+	try {
+		const parsedMetadata = parseSAMLServiceProviderMetadata(metadata);
+		if (!parsedMetadata.postAssertionConsumerServiceUrls.length) throw new Error("Unusable SAML service provider metadata");
+		return { wantAssertionsSigned: parsedMetadata.wantAssertionsSigned };
+	} catch {
+		throw new APIError("BAD_REQUEST", {
+			code: "SAML_INVALID_SP_METADATA",
+			message: "Invalid SAML service provider metadata"
+		});
+	}
+}
+function assertSAMLIdentityProviderAuthority(config) {
+	if (config.idpMetadata?.metadata || config.idpMetadata?.entityID) return;
+	throw new APIError("BAD_REQUEST", { message: "SAML manual IdP configuration requires idpMetadata.entityID; issuer identifies the service provider and cannot identify the IdP" });
+}
+function createIdP(config) {
+	assertSAMLIdentityProviderAuthority(config);
+	const idpData = config.idpMetadata;
+	if (idpData?.metadata) return saml.IdentityProvider({
+		metadata: idpData.metadata,
+		privateKey: normalizePem(idpData.privateKey),
+		privateKeyPass: idpData.privateKeyPass,
+		isAssertionEncrypted: idpData.isAssertionEncrypted,
+		encPrivateKey: normalizePem(idpData.encPrivateKey),
+		encPrivateKeyPass: idpData.encPrivateKeyPass
+	});
+	return saml.IdentityProvider({
+		entityID: idpData.entityID,
+		singleSignOnService: idpData.singleSignOnService || [{
+			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
+			Location: config.entryPoint
+		}],
+		singleLogoutService: idpData.singleLogoutService,
+		signingCert: normalizePemList(resolveSigningCerts(config)),
+		wantAuthnRequestsSigned: config.authnRequestsSigned || false,
+		isAssertionEncrypted: idpData.isAssertionEncrypted || false,
+		encPrivateKey: normalizePem(idpData.encPrivateKey),
+		encPrivateKeyPass: idpData.encPrivateKeyPass
+	});
+}
+/**
+* Derive the verified SAML identity-provider entity ID using the same metadata
+* parsing and manual-configuration validation as SAML authentication.
+*/
+function deriveSAMLIdentityProviderEntityID(config) {
+	return createIdP(config).entityMeta.getEntityID();
+}
+function escapeHtml(str) {
+	if (!str) return "";
+	return String(str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function isSAMLPostBindingLocation(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	return url.protocol === "http:" || url.protocol === "https:";
+}
+function createSAMLPostForm(action, samlParam, samlValue, relayState) {
+	if (!isSAMLPostBindingLocation(action)) throw new APIError("BAD_REQUEST", { message: "SAML POST binding location must be an absolute http or https URL" });
+	const safeAction = escapeHtml(action);
+	const safeSamlParam = escapeHtml(samlParam);
+	const safeSamlValue = escapeHtml(samlValue);
+	const safeRelayState = relayState ? escapeHtml(relayState) : void 0;
+	const html = `<!DOCTYPE html><html><body onload="document.forms[0].submit();"><form method="POST" action="${safeAction}"><input type="hidden" name="${safeSamlParam}" value="${safeSamlValue}" />${safeRelayState ? `<input type="hidden" name="RelayState" value="${safeRelayState}" />` : ""}<noscript><input type="submit" value="Continue" /></noscript></form></body></html>`;
+	return new Response(html, { headers: { "Content-Type": "text/html" } });
+}
+//#endregion
 //#region src/routes/schemas.ts
+const absoluteUrlSchema = z.url();
+const samlRedirectUrlSchema = z.string().refine((url) => isSafeSAMLRedirectPath(url) || absoluteUrlSchema.safeParse(url).success, { message: "Expected an absolute URL or a relative path starting with /" });
 function getSSOProviderAdditionalFields$1(options) {
 	return options?.schema?.ssoProvider?.additionalFields ?? {};
 }
@@ -1327,16 +1801,14 @@ function parseSSOProviderAdditionalFields(options, data, action) {
 		action
 	});
 }
-const oidcMappingSchema = z.object({
-	id: z.string().meta({ description: "Field mapping for user ID (defaults to 'sub')" }),
+const oidcMappingSchema = z.strictObject({
 	email: z.string().meta({ description: "Field mapping for email (defaults to 'email')" }),
 	emailVerified: z.string().meta({ description: "Field mapping for email verification (defaults to 'email_verified')" }).optional(),
 	name: z.string().meta({ description: "Field mapping for name (defaults to 'name')" }),
 	image: z.string().meta({ description: "Field mapping for image (defaults to 'picture')" }).optional(),
 	extraFields: z.record(z.string(), z.any()).optional()
 }).optional();
-const samlMappingSchema = z.object({
-	id: z.string().meta({ description: "Field mapping for user ID (defaults to 'nameID')" }),
+const samlMappingSchema = z.strictObject({
 	email: z.string().meta({ description: "Field mapping for email (defaults to 'email')" }),
 	emailVerified: z.string().meta({ description: "Field mapping for email verification" }).optional(),
 	name: z.string().meta({ description: "Field mapping for name (defaults to 'displayName')" }),
@@ -1366,29 +1838,40 @@ const oidcConfigSchema = z.object({
 	overrideUserInfo: z.boolean().optional(),
 	mapping: oidcMappingSchema
 });
+const samlIdentityProviderConfigSchema = z.object({
+	cert: signingCertSchema.meta({ description: "IdP signing certificate(s). Pass a single PEM string or an array for rolling rotation. Takes precedence over the top-level `cert`." }).optional(),
+	privateKey: z.string().optional(),
+	privateKeyPass: z.string().optional(),
+	isAssertionEncrypted: z.boolean().optional(),
+	encPrivateKey: z.string().optional(),
+	encPrivateKeyPass: z.string().optional(),
+	singleSignOnService: z.array(z.object({
+		Binding: z.string().meta({ description: "The binding type for the SSO service" }),
+		Location: z.string().url().meta({ description: "The URL for the SSO service" })
+	})).meta({ description: "Single Sign-On service configuration" }).optional(),
+	singleLogoutService: z.array(z.object({
+		Binding: z.string(),
+		Location: z.string().url()
+	})).optional()
+});
+const samlIdentityProviderMetadataSchema = z.union([samlIdentityProviderConfigSchema.extend({
+	metadata: z.string().min(1),
+	entityID: z.string().optional()
+}), samlIdentityProviderConfigSchema.extend({
+	metadata: z.undefined().optional(),
+	entityID: z.string().min(1)
+})], "idpMetadata.entityID is required when IdP metadata XML is not provided");
+const samlIdentityProviderMetadataUpdateSchema = samlIdentityProviderConfigSchema.extend({
+	metadata: z.string().min(1).optional(),
+	entityID: z.string().min(1).optional()
+});
 const samlConfigSchema = z.object({
 	entryPoint: z.string().url().meta({ description: "The IdP SSO URL (entry point)" }),
 	cert: signingCertSchema.meta({ description: "IdP signing certificate(s). Pass a single PEM string or an array for rolling rotation. Omit when `idpMetadata.metadata` XML carries the certs. When both this and `idpMetadata.cert` are set, `idpMetadata.cert` wins." }).optional(),
 	audience: z.string().optional(),
 	callbackUrl: z.string().refine((url) => !url.includes("#"), { message: "callbackUrl must not contain a fragment" }).optional(),
-	idpMetadata: z.object({
-		metadata: z.string().optional(),
-		entityID: z.string().optional(),
-		cert: signingCertSchema.meta({ description: "IdP signing certificate(s). Pass a single PEM string or an array for rolling rotation. Takes precedence over the top-level `cert`." }).optional(),
-		privateKey: z.string().optional(),
-		privateKeyPass: z.string().optional(),
-		isAssertionEncrypted: z.boolean().optional(),
-		encPrivateKey: z.string().optional(),
-		encPrivateKeyPass: z.string().optional(),
-		singleSignOnService: z.array(z.object({
-			Binding: z.string().meta({ description: "The binding type for the SSO service" }),
-			Location: z.string().url().meta({ description: "The URL for the SSO service" })
-		})).meta({ description: "Single Sign-On service configuration" }).optional(),
-		singleLogoutService: z.array(z.object({
-			Binding: z.string(),
-			Location: z.string().url()
-		})).optional()
-	}).optional(),
+	idpInitiatedCallbackUrl: samlRedirectUrlSchema.optional(),
+	idpMetadata: samlIdentityProviderMetadataSchema,
 	spMetadata: z.object({
 		metadata: z.string().optional(),
 		entityID: z.string().optional(),
@@ -1423,7 +1906,10 @@ const updateSSOProviderBodySchema = z.object({
 	issuer: z.string().url().optional(),
 	domain: z.string().optional(),
 	oidcConfig: oidcConfigSchema.partial().optional(),
-	samlConfig: samlConfigSchema.partial().optional()
+	samlConfig: samlConfigSchema.omit({ idpMetadata: true }).partial().extend({
+		idpInitiatedCallbackUrl: samlRedirectUrlSchema.nullable().optional(),
+		idpMetadata: samlIdentityProviderMetadataUpdateSchema.optional()
+	}).optional()
 });
 function getUpdateSSOProviderBodySchema(options) {
 	return updateSSOProviderBodySchema.extend({
@@ -1442,18 +1928,7 @@ const OIDC_IDENTITY_BOUNDARY_FIELDS = [
 	"tokenEndpoint",
 	"userInfoEndpoint"
 ];
-const SAML_IDENTITY_BOUNDARY_FIELDS = [
-	"audience",
-	"callbackUrl",
-	"entryPoint",
-	"identifierFormat"
-];
-const SAML_IDP_BOUNDARY_FIELDS = [
-	"metadata",
-	"entityID",
-	"singleSignOnService"
-];
-const SAML_SP_BOUNDARY_FIELDS = ["metadata", "entityID"];
+const SAML_IDENTITY_BOUNDARY_FIELDS = ["audience", "callbackUrl"];
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1469,10 +1944,37 @@ function hasChangedField(current, updated, fields) {
 	return fields.some((field) => identityValueChanged(current?.[field], updated?.[field]));
 }
 function oidcIdentityBoundaryChanged(current, updated) {
-	return hasChangedField(current, updated, OIDC_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(current.mapping?.id, updated.mapping?.id);
+	return hasChangedField(current, updated, OIDC_IDENTITY_BOUNDARY_FIELDS);
 }
 function samlIdentityBoundaryChanged(current, updated) {
-	return hasChangedField(current, updated, SAML_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(current.mapping?.id, updated.mapping?.id) || hasChangedField(current.idpMetadata, updated.idpMetadata, SAML_IDP_BOUNDARY_FIELDS) || hasChangedField(current.spMetadata, updated.spMetadata, SAML_SP_BOUNDARY_FIELDS);
+	const currentIdentityProvider = createIdP(current).entityMeta;
+	const updatedIdentityProvider = createIdP(updated).entityMeta;
+	let currentServiceProvider;
+	let updatedServiceProvider;
+	try {
+		currentServiceProvider = current.spMetadata?.metadata ? parseSAMLServiceProviderMetadata(current.spMetadata.metadata) : null;
+		updatedServiceProvider = updated.spMetadata?.metadata ? parseSAMLServiceProviderMetadata(updated.spMetadata.metadata) : null;
+	} catch {
+		return true;
+	}
+	const effectiveIdentityBoundary = (config) => {
+		const identityProvider = config === current ? currentIdentityProvider : updatedIdentityProvider;
+		const serviceProvider = config === current ? currentServiceProvider : updatedServiceProvider;
+		return {
+			idpEntityId: identityProvider.getEntityID(),
+			idpRedirectService: identityProvider.getSingleSignOnService("redirect"),
+			idpPostService: identityProvider.getSingleSignOnService("post"),
+			spEntityId: serviceProvider?.entityID ?? config.spMetadata?.entityID ?? config.issuer,
+			spNameIDFormat: serviceProvider?.nameIDFormats.at(0) ?? config.identifierFormat,
+			spPostServices: serviceProvider ? getSAMLPostAssertionConsumerServiceUrls(config.spMetadata?.metadata) : config.callbackUrl ? [config.callbackUrl] : [],
+			wantAssertionsSigned: serviceProvider?.wantAssertionsSigned ?? config.wantAssertionsSigned === true
+		};
+	};
+	const trustAnchors = (identityProvider) => {
+		const certificates = identityProvider.getX509Certificate("signing");
+		return (Array.isArray(certificates) ? certificates : certificates ? [certificates] : []).map((certificate) => normalizePem(certificate) ?? certificate).sort();
+	};
+	return hasChangedField(current, updated, SAML_IDENTITY_BOUNDARY_FIELDS) || identityValueChanged(trustAnchors(currentIdentityProvider), trustAnchors(updatedIdentityProvider)) || identityValueChanged(effectiveIdentityBoundary(current), effectiveIdentityBoundary(updated));
 }
 function parseConfigSnapshot(config, configType) {
 	if (!config) return;
@@ -1488,25 +1990,71 @@ function ssoProviderIdentityBoundaryChanged(current, updated) {
 	const updatedOidcConfig = parseConfigSnapshot(updated.oidcConfig, "OIDC");
 	return Boolean(currentOidcConfig && (!updatedOidcConfig || oidcIdentityBoundaryChanged(currentOidcConfig, updatedOidcConfig)));
 }
-async function lockSSOProviderRow(adapter, providerId) {
-	return (await getCurrentAdapter(adapter)).update({
+async function lockSSOProviderRow(context, provider) {
+	const where = [...provider.id ? [{
+		field: "id",
+		value: provider.id
+	}] : [], {
+		field: "providerId",
+		value: provider.providerId
+	}];
+	return (await getCurrentAdapter(context.adapter)).update({
 		model: "ssoProvider",
-		where: [{
-			field: "providerId",
-			value: providerId
-		}],
-		update: { providerId }
+		where,
+		update: { providerId: provider.providerId }
 	});
 }
-async function lockSSOProviderForAccountLink(ctx, provider) {
-	const lockedProvider = await lockSSOProviderRow(ctx.context.adapter, provider.providerId);
-	if (!lockedProvider) {
-		if (provider.userId === "default") return;
+async function guardSSOProviderMutation(options, mutation, provider, database, logger) {
+	if (!options?.guardProviderMutation) return;
+	const oidcConfig = provider.oidcConfig ? parseConfigSnapshot(provider.oidcConfig, "OIDC") : void 0;
+	const samlConfig = provider.samlConfig ? parseConfigSnapshot(provider.samlConfig, "SAML") : void 0;
+	const providerReference = await computeSSOProviderReference({
+		...provider,
+		organizationId: provider.organizationId ?? void 0,
+		oidcConfig,
+		samlConfig
+	});
+	try {
+		await options.guardProviderMutation({
+			...mutation,
+			provider: {
+				id: provider.id,
+				providerId: provider.providerId,
+				organizationId: provider.organizationId ?? null
+			},
+			providerReference
+		}, { database });
+	} catch {
+		try {
+			logger.error("SSO provider mutation guard rejected the mutation");
+		} catch {}
 		throw new APIError("CONFLICT", {
-			code: "SSO_PROVIDER_CHANGED",
-			message: "SSO provider changed while account linking was in progress"
+			code: "SSO_PROVIDER_MUTATION_REJECTED",
+			message: "SSO provider mutation is not allowed"
 		});
 	}
+}
+async function assertProviderMutationGuardCapabilities(options, adapter) {
+	if (!options?.guardProviderMutation) return;
+	assertSSONativeTransactionSupport(adapter, {
+		code: "SSO_PROVIDER_MUTATION_GUARD_REQUIRES_NATIVE_TRANSACTIONS",
+		message: "SSO provider mutation guards require a database adapter with native transaction support"
+	});
+	await assertSSOAsyncContextSupport({
+		code: "SSO_PROVIDER_MUTATION_GUARD_REQUIRES_ASYNC_CONTEXT",
+		message: "SSO provider mutation guards require database transaction async context support"
+	});
+}
+async function lockSSOProviderForAccountLink(ctx, provider) {
+	if (typeof provider.id !== "string") return;
+	const lockedProvider = await lockSSOProviderRow(ctx.context, {
+		id: provider.id,
+		providerId: provider.providerId
+	});
+	if (!lockedProvider) throw new APIError("CONFLICT", {
+		code: "SSO_PROVIDER_CHANGED",
+		message: "SSO provider changed while account linking was in progress"
+	});
 	if (ssoProviderIdentityBoundaryChanged(provider, lockedProvider)) throw new APIError("CONFLICT", {
 		code: "SSO_PROVIDER_CHANGED",
 		message: "SSO provider changed while account linking was in progress"
@@ -1607,6 +2155,8 @@ function sanitizeProvider(provider, baseURL, options) {
 		} : void 0,
 		samlConfig: samlConfig ? {
 			entryPoint: samlConfig.entryPoint,
+			callbackUrl: samlConfig.callbackUrl,
+			idpInitiatedCallbackUrl: samlConfig.idpInitiatedCallbackUrl,
 			audience: samlConfig.audience,
 			wantAssertionsSigned: samlConfig.wantAssertionsSigned,
 			authnRequestsSigned: samlConfig.authnRequestsSigned,
@@ -1696,6 +2246,15 @@ function parseAndValidateConfig(configString, configType) {
 	if (!config) throw new APIError("BAD_REQUEST", { message: `Cannot update ${configType} config for a provider that doesn't have ${configType} configured` });
 	return config;
 }
+function mergeSAMLIdentityProviderMetadata(current, updates) {
+	if (!updates) return current;
+	const config = { idpMetadata: {
+		...current,
+		...updates
+	} };
+	assertSAMLIdentityProviderAuthority(config);
+	return config.idpMetadata;
+}
 function mergeSAMLConfig(current, updates, issuer) {
 	return {
 		...current,
@@ -1703,11 +2262,15 @@ function mergeSAMLConfig(current, updates, issuer) {
 		issuer,
 		entryPoint: updates.entryPoint ?? current.entryPoint,
 		cert: updates.cert ?? current.cert,
-		spMetadata: updates.spMetadata ?? current.spMetadata,
-		idpMetadata: updates.idpMetadata ?? current.idpMetadata,
+		spMetadata: updates.spMetadata ? {
+			...current.spMetadata,
+			...updates.spMetadata
+		} : current.spMetadata,
+		idpMetadata: mergeSAMLIdentityProviderMetadata(current.idpMetadata, updates.idpMetadata),
 		mapping: updates.mapping ?? current.mapping,
 		audience: updates.audience ?? current.audience,
 		callbackUrl: updates.callbackUrl ?? current.callbackUrl,
+		idpInitiatedCallbackUrl: updates.idpInitiatedCallbackUrl === null ? void 0 : updates.idpInitiatedCallbackUrl ?? current.idpInitiatedCallbackUrl,
 		wantAssertionsSigned: updates.wantAssertionsSigned ?? current.wantAssertionsSigned,
 		authnRequestsSigned: updates.authnRequestsSigned ?? current.authnRequestsSigned,
 		identifierFormat: updates.identifierFormat ?? current.identifierFormat,
@@ -1756,10 +2319,14 @@ const updateSSOProvider = (options) => {
 		const { issuer, domain, samlConfig, oidcConfig } = body;
 		const additionalFields = parseSSOProviderAdditionalFields(options, body, "update");
 		if (!issuer && !domain && !samlConfig && !oidcConfig && Object.keys(additionalFields).length === 0) throw new APIError("BAD_REQUEST", { message: "No fields provided for update" });
-		await checkProviderAccess(ctx, providerId);
+		const authorizedProvider = await checkProviderAccess(ctx, providerId);
+		await assertProviderMutationGuardCapabilities(options, ctx.context.adapter);
 		const fullProvider = await runWithTransaction(ctx.context.adapter, async () => {
 			const trx = await getCurrentAdapter(ctx.context.adapter);
-			const existingProvider = await lockSSOProviderRow(ctx.context.adapter, providerId);
+			const existingProvider = await lockSSOProviderRow(ctx.context, {
+				id: authorizedProvider.id,
+				providerId
+			});
 			if (!existingProvider) throw new APIError("NOT_FOUND", { message: "Provider not found" });
 			const updateData = { ...additionalFields };
 			let providerIdentityBoundaryChanged = body.issuer !== void 0 && body.issuer !== existingProvider.issuer;
@@ -1769,10 +2336,9 @@ const updateSSOProvider = (options) => {
 				if (body.domain !== existingProvider.domain) updateData.domainVerified = false;
 			}
 			if (body.samlConfig) {
-				if (body.samlConfig.idpMetadata?.metadata) {
-					const maxMetadataSize = options?.saml?.maxMetadataSize ?? 102400;
-					if (new TextEncoder().encode(body.samlConfig.idpMetadata.metadata).length > maxMetadataSize) throw new APIError("BAD_REQUEST", { message: `IdP metadata exceeds maximum allowed size (${maxMetadataSize} bytes)` });
-				}
+				const maxMetadataSize = options?.saml?.maxMetadataSize ?? 102400;
+				assertSAMLMetadataSize(body.samlConfig.idpMetadata?.metadata, "IdP", maxMetadataSize);
+				assertSAMLMetadataSize(body.samlConfig.spMetadata?.metadata, "SP", maxMetadataSize);
 				if (body.samlConfig.signatureAlgorithm !== void 0 || body.samlConfig.digestAlgorithm !== void 0) validateConfigAlgorithms({
 					signatureAlgorithm: body.samlConfig.signatureAlgorithm,
 					digestAlgorithm: body.samlConfig.digestAlgorithm
@@ -1780,6 +2346,8 @@ const updateSSOProvider = (options) => {
 				const currentSamlConfig = parseAndValidateConfig(existingProvider.samlConfig, "SAML");
 				const updatedSamlConfig = mergeSAMLConfig(currentSamlConfig, body.samlConfig, updateData.issuer || currentSamlConfig.issuer || existingProvider.issuer);
 				validateCertSources(updatedSamlConfig);
+				assertSAMLIdentityProviderAuthority(updatedSamlConfig);
+				assertSAMLServiceProviderMetadataPolicy(updatedSamlConfig);
 				if (samlIdentityBoundaryChanged(currentSamlConfig, updatedSamlConfig)) providerIdentityBoundaryChanged = true;
 				updateData.samlConfig = JSON.stringify(updatedSamlConfig);
 			}
@@ -1797,6 +2365,10 @@ const updateSSOProvider = (options) => {
 				if (oidcIdentityBoundaryChanged(currentOidcConfig, updatedOidcConfig)) providerIdentityBoundaryChanged = true;
 				updateData.oidcConfig = JSON.stringify(updatedOidcConfig);
 			}
+			await guardSSOProviderMutation(options, {
+				action: "update",
+				isAuthenticationBoundaryChange: providerIdentityBoundaryChanged
+			}, existingProvider, trx, ctx.context.logger);
 			if (providerIdentityBoundaryChanged) {
 				if (await trx.findOne({
 					model: "account",
@@ -1827,7 +2399,7 @@ const updateSSOProvider = (options) => {
 		return ctx.json(sanitizeProvider(fullProvider, ctx.context.baseURL, options));
 	});
 };
-const deleteSSOProvider = () => {
+const deleteSSOProvider = (options) => {
 	return createAuthEndpoint("/sso/delete-provider", {
 		method: "POST",
 		use: [sessionMiddleware],
@@ -1844,9 +2416,16 @@ const deleteSSOProvider = () => {
 		} }
 	}, async (ctx) => {
 		const { providerId } = ctx.body;
-		await checkProviderAccess(ctx, providerId);
+		const authorizedProvider = await checkProviderAccess(ctx, providerId);
+		await assertProviderMutationGuardCapabilities(options, ctx.context.adapter);
 		await runWithTransaction(ctx.context.adapter, async () => {
 			const trx = await getCurrentAdapter(ctx.context.adapter);
+			const existingProvider = await lockSSOProviderRow(ctx.context, {
+				id: authorizedProvider.id,
+				providerId
+			});
+			if (!existingProvider) throw new APIError("NOT_FOUND", { message: "Provider not found" });
+			await guardSSOProviderMutation(options, { action: "delete" }, existingProvider, trx, ctx.context.logger);
 			await trx.deleteMany({
 				model: "account",
 				where: [{
@@ -1857,6 +2436,9 @@ const deleteSSOProvider = () => {
 			await trx.delete({
 				model: "ssoProvider",
 				where: [{
+					field: "id",
+					value: existingProvider.id
+				}, {
 					field: "providerId",
 					value: providerId
 				}]
@@ -1987,7 +2569,7 @@ const verifyDomain = (options) => {
 };
 //#endregion
 //#region src/saml-state.ts
-async function generateRelayState(c, link) {
+async function generateRelayState(c, link, providerReference) {
 	const callbackURL = c.body.callbackURL;
 	if (!callbackURL) throw new APIError("BAD_REQUEST", { message: "callbackURL is required" });
 	const stateData = {
@@ -1996,8 +2578,12 @@ async function generateRelayState(c, link) {
 		errorURL: c.body.errorCallbackURL,
 		newUserURL: c.body.newUserCallbackURL,
 		link,
+		/**
+		* This is the actual expiry time of the state
+		*/
 		expiresAt: Date.now() + 600 * 1e3,
-		requestSignUp: c.body.requestSignUp
+		requestSignUp: c.body.requestSignUp,
+		serverContext: providerReference ? { [SSO_PROVIDER_STATE_KEY]: providerReference } : void 0
 	};
 	try {
 		return generateGenericState(c, stateData, { cookieName: "relay_state" });
@@ -2016,6 +2602,10 @@ async function parseRelayState(c) {
 	try {
 		parsedData = await parseGenericState(c, state, {
 			cookieName: "relay_state",
+			/**
+			* SAML ACS receives a POST from the IdP, which is typically cross-origin.
+			* SameSite=Lax (default) cookies are not sent on cross-site POST requests.
+			*/
 			skipStateCookieCheck: true
 		});
 	} catch (error) {
@@ -2028,122 +2618,6 @@ async function parseRelayState(c) {
 	if (!parsedData.errorURL) parsedData.errorURL = errorURL;
 	return parsedData;
 }
-const saml = typeof samlifyNamespace.SPMetadata === "function" && typeof samlifyNamespace.setSchemaValidator === "function" ? samlifyNamespace : samlifyDefault ?? samlifyNamespace;
-//#endregion
-//#region src/routes/helpers.ts
-/**
-* Same as `normalizePem`, but applied across the resolved list of IdP signing
-* certificates so multi-cert rotation configs survive the line-trim step.
-*/
-function normalizePemList(certs) {
-	if (!certs) return certs;
-	return certs.map((pem) => normalizePem(pem) ?? pem);
-}
-async function findSAMLProvider(providerId, options, adapter) {
-	if (options?.defaultSSO?.length) {
-		const match = options.defaultSSO.find((p) => p.providerId === providerId);
-		if (match) return {
-			...match,
-			userId: "default",
-			issuer: match.samlConfig?.issuer || "",
-			...options.domainVerification?.enabled ? { domainVerified: true } : {}
-		};
-	}
-	const res = await adapter.findOne({
-		model: "ssoProvider",
-		where: [{
-			field: "providerId",
-			value: providerId
-		}]
-	});
-	if (!res) return null;
-	return {
-		...res,
-		samlConfig: res.samlConfig ? safeJsonParse(res.samlConfig) || void 0 : void 0
-	};
-}
-function createSP(config, baseURL, providerId, opts) {
-	const spData = config.spMetadata;
-	const sloLocation = `${baseURL}/sso/saml2/sp/slo/${providerId}`;
-	const acsUrl = `${baseURL}/sso/saml2/sp/acs/${providerId}`;
-	let metadata = spData?.metadata;
-	if (!metadata) metadata = saml.SPMetadata({
-		entityID: spData?.entityID || config.issuer,
-		assertionConsumerService: [{
-			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-			Location: acsUrl
-		}],
-		singleLogoutService: opts?.sloOptions ? [{
-			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
-			Location: sloLocation
-		}, {
-			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
-			Location: sloLocation
-		}] : void 0,
-		wantMessageSigned: config.wantAssertionsSigned || false,
-		authnRequestsSigned: config.authnRequestsSigned || false,
-		nameIDFormat: config.identifierFormat ? [config.identifierFormat] : void 0
-	}).getMetadata() || "";
-	return saml.ServiceProvider({
-		metadata,
-		allowCreate: true,
-		wantLogoutRequestSigned: opts?.sloOptions?.wantLogoutRequestSigned ?? false,
-		wantLogoutResponseSigned: opts?.sloOptions?.wantLogoutResponseSigned ?? false,
-		privateKey: normalizePem(spData?.privateKey || config.privateKey),
-		privateKeyPass: spData?.privateKeyPass,
-		isAssertionEncrypted: spData?.isAssertionEncrypted || false,
-		encPrivateKey: normalizePem(spData?.encPrivateKey),
-		encPrivateKeyPass: spData?.encPrivateKeyPass,
-		relayState: opts?.relayState,
-		clockDrifts: opts?.clockSkew && opts?.clockSkew !== 0 ? [-opts.clockSkew, opts.clockSkew] : void 0
-	});
-}
-function createIdP(config) {
-	const idpData = config.idpMetadata;
-	if (idpData?.metadata) return saml.IdentityProvider({
-		metadata: idpData.metadata,
-		privateKey: normalizePem(idpData.privateKey),
-		privateKeyPass: idpData.privateKeyPass,
-		isAssertionEncrypted: idpData.isAssertionEncrypted,
-		encPrivateKey: normalizePem(idpData.encPrivateKey),
-		encPrivateKeyPass: idpData.encPrivateKeyPass
-	});
-	return saml.IdentityProvider({
-		entityID: idpData?.entityID || config.issuer,
-		singleSignOnService: idpData?.singleSignOnService || [{
-			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
-			Location: config.entryPoint
-		}],
-		singleLogoutService: idpData?.singleLogoutService,
-		signingCert: normalizePemList(resolveSigningCerts(config)),
-		wantAuthnRequestsSigned: config.authnRequestsSigned || false,
-		isAssertionEncrypted: idpData?.isAssertionEncrypted || false,
-		encPrivateKey: normalizePem(idpData?.encPrivateKey),
-		encPrivateKeyPass: idpData?.encPrivateKeyPass
-	});
-}
-function escapeHtml(str) {
-	if (!str) return "";
-	return String(str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-function isSAMLPostBindingLocation(value) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		return false;
-	}
-	return url.protocol === "http:" || url.protocol === "https:";
-}
-function createSAMLPostForm(action, samlParam, samlValue, relayState) {
-	if (!isSAMLPostBindingLocation(action)) throw new APIError("BAD_REQUEST", { message: "SAML POST binding location must be an absolute http or https URL" });
-	const safeAction = escapeHtml(action);
-	const safeSamlParam = escapeHtml(samlParam);
-	const safeSamlValue = escapeHtml(samlValue);
-	const safeRelayState = relayState ? escapeHtml(relayState) : void 0;
-	const html = `<!DOCTYPE html><html><body onload="document.forms[0].submit();"><form method="POST" action="${safeAction}"><input type="hidden" name="${safeSamlParam}" value="${safeSamlValue}" />${safeRelayState ? `<input type="hidden" name="RelayState" value="${safeRelayState}" />` : ""}<noscript><input type="submit" value="Continue" /></noscript></form></body></html>`;
-	return new Response(html, { headers: { "Content-Type": "text/html" } });
-}
 //#endregion
 //#region src/saml/timestamp.ts
 /**
@@ -2187,42 +2661,47 @@ function validateSAMLTimestamp(conditions, options = {}) {
 }
 //#endregion
 //#region src/routes/saml-pipeline.ts
-/**
-* Validates and returns a safe redirect URL.
-* - Prevents open redirect attacks by validating against trusted origins
-* - Prevents redirect loops by checking if URL points to callback route
-* - Falls back to appOrigin if URL is invalid or unsafe
-*/
-function getSafeRedirectUrl(url, callbackPath, appOrigin, isTrustedOrigin) {
-	if (!url) return appOrigin;
-	if (url.startsWith("/") && !url.startsWith("//")) {
+function isSameSSOProviderReference(left, right) {
+	if (left.providerId !== right.providerId || left.authenticationConfigurationFingerprint !== right.authenticationConfigurationFingerprint || left.source.type !== right.source.type) return false;
+	return left.source.type === "configured" ? true : right.source.type === "persisted" && left.source.recordId === right.source.recordId;
+}
+function getSafeRedirectCandidate(url, callbackPathname, appOrigin, isTrustedOrigin) {
+	if (!url) return;
+	if (url.startsWith("/")) {
+		if (!isSafeSAMLRedirectPath(url)) return;
 		try {
 			const absoluteUrl = new URL(url, appOrigin);
-			if (absoluteUrl.origin !== appOrigin) return appOrigin;
-			const callbackPathname = new URL(callbackPath).pathname;
-			if (absoluteUrl.pathname === callbackPathname) return appOrigin;
+			if (absoluteUrl.origin !== appOrigin || absoluteUrl.pathname === callbackPathname) return;
+			return url;
 		} catch {
-			return appOrigin;
+			return;
 		}
-		return url;
 	}
+	let absoluteUrl;
 	try {
-		const absoluteUrl = new URL(url);
-		if (absoluteUrl.origin === appOrigin) {
-			const callbackPathname = new URL(callbackPath).pathname;
-			if (absoluteUrl.pathname === callbackPathname) return appOrigin;
-			return url;
-		}
-	} catch {}
-	if (!isTrustedOrigin(url, { allowRelativePaths: false })) return appOrigin;
-	try {
-		const callbackPathname = new URL(callbackPath).pathname;
-		if (new URL(url).pathname === callbackPathname) return appOrigin;
+		absoluteUrl = new URL(url);
 	} catch {
-		if (url === callbackPath || url.startsWith(`${callbackPath}?`)) return appOrigin;
+		return;
 	}
+	if (absoluteUrl.origin !== appOrigin && !isTrustedOrigin(url, { allowRelativePaths: false })) return;
+	if (absoluteUrl.origin === appOrigin && absoluteUrl.pathname === callbackPathname) return;
 	return url;
 }
+/**
+* Returns the first safe redirect URL from an ordered list of candidates.
+* - Prevents open redirect attacks by validating against trusted origins
+* - Prevents redirect loops by checking if URL points to callback route
+* - Tries the next candidate when a URL is invalid or unsafe
+* - Falls back to appOrigin when no candidate is safe
+*/
+function getSafeRedirectUrl(candidates, callbackPath, appOrigin, isTrustedOrigin) {
+	const callbackPathname = new URL(callbackPath).pathname;
+	for (const candidate of candidates) {
+		const safeCandidate = getSafeRedirectCandidate(candidate, callbackPathname, appOrigin, isTrustedOrigin);
+		if (safeCandidate) return safeCandidate;
+	}
+	return appOrigin;
+}
 function buildSAMLRedirectUrl(url, params) {
 	const searchParams = new URLSearchParams(params);
 	try {
@@ -2238,6 +2717,14 @@ function buildSAMLRedirectUrl(url, params) {
 		return `${urlWithoutFragment}${urlWithoutFragment.includes("?") ? "&" : "?"}${searchParams.toString()}${fragment}`;
 	}
 }
+function getSAMLRedirectCandidates(relayStateCallbackUrl, samlConfig, samlOptions) {
+	return [
+		relayStateCallbackUrl,
+		samlConfig?.idpInitiatedCallbackUrl,
+		samlOptions?.idpInitiatedCallbackUrl,
+		samlConfig?.callbackUrl
+	];
+}
 function toArray(value) {
 	if (Array.isArray(value)) return value;
 	return value ? [value] : [];
@@ -2292,10 +2779,11 @@ async function processSAMLResponse(ctx, params, options) {
 	if (new TextEncoder().encode(params.SAMLResponse).length > maxResponseSize) throw new APIError("BAD_REQUEST", { message: `SAML response exceeds maximum allowed size (${maxResponseSize} bytes)` });
 	const SAMLResponse = params.SAMLResponse.replace(/\s+/g, "");
 	let relayState = null;
+	let relayStateValidationFailed = false;
 	if (params.RelayState) try {
 		relayState = await parseRelayState(ctx);
 	} catch {
-		relayState = null;
+		relayStateValidationFailed = true;
 	}
 	const provider = await findSAMLProvider(providerId, options, ctx.context.adapter);
 	if (!provider?.samlConfig) throw new APIError("NOT_FOUND", { message: "No SAML provider found" });
@@ -2304,7 +2792,11 @@ async function processSAMLResponse(ctx, params, options) {
 	if (!parsedSamlConfig) throw new APIError("BAD_REQUEST", { message: "Invalid SAML configuration" });
 	const sp = createSP(parsedSamlConfig, ctx.context.baseURL, providerId, { clockSkew: options?.saml?.clockSkew });
 	const idp = createIdP(parsedSamlConfig);
-	const samlRedirectUrl = getSafeRedirectUrl(relayState?.callbackURL || parsedSamlConfig.callbackUrl, params.currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	const redirectCandidates = getSAMLRedirectCandidates(relayState?.callbackURL, parsedSamlConfig, options?.saml);
+	const samlRedirectUrl = getSafeRedirectUrl(redirectCandidates, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	const samlErrorRedirectUrl = getSafeRedirectUrl([relayState?.errorURL, samlRedirectUrl], currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	params.onErrorRedirectResolved?.(samlErrorRedirectUrl);
+	const stateProviderReference = parseSSOProviderReference(relayState?.serverContext?.[SSO_PROVIDER_STATE_KEY]);
 	validateSingleAssertion(SAMLResponse);
 	let parsedResponse;
 	try {
@@ -2313,15 +2805,9 @@ async function processSAMLResponse(ctx, params, options) {
 			RelayState: params.RelayState || void 0
 		} });
 		if (!parsedResponse?.extract) throw new Error("Invalid SAML response structure");
-	} catch (error) {
-		ctx.context.logger.error("SAML response validation failed", {
-			error,
-			samlResponsePreview: SAMLResponse.slice(0, 200)
-		});
-		throw new APIError("BAD_REQUEST", {
-			message: "Invalid SAML response",
-			details: error instanceof Error ? error.message : String(error)
-		});
+	} catch {
+		ctx.context.logger.error("SAML response validation failed");
+		throw new APIError("BAD_REQUEST", { message: "Invalid SAML response" });
 	}
 	const { extract } = parsedResponse;
 	const samlContent = parsedResponse.samlContent;
@@ -2334,9 +2820,14 @@ async function processSAMLResponse(ctx, params, options) {
 	const expectedAudiences = [sp.entityMeta.getEntityID(), parsedSamlConfig.audience];
 	const assertionConsumerServiceUrl = sp.entityMeta.getAssertionConsumerService(SAML_HTTP_POST_BINDING);
 	const expectedRecipients = getExpectedSAMLRecipients(parsedSamlConfig, ctx.context.baseURL, providerId, currentCallbackPath, assertionConsumerServiceUrl);
+	const serviceProviderPolicy = deriveSAMLServiceProviderPolicy(parsedSamlConfig);
 	let samlBindingContent;
 	try {
 		samlBindingContent = await getSAMLResponseBindingContent(sp, samlContent);
+		if (serviceProviderPolicy.wantAssertionsSigned) verifySAMLAssertionSignature(samlBindingContent, {
+			metadata: idp.entityMeta,
+			signatureAlgorithm: idp.entitySetting.requestSignatureAlgorithm
+		});
 		validateSAMLResponseBinding(samlBindingContent, {
 			expectedAudiences,
 			expectedRecipients
@@ -2345,44 +2836,54 @@ async function processSAMLResponse(ctx, params, options) {
 		if (isAPIError(error)) {
 			ctx.context.logger.error("SAML response binding validation failed", {
 				providerId,
-				code: error.body?.code,
-				expectedAudiences: expectedAudiences.filter(Boolean),
-				expectedRecipients: expectedRecipients.filter(Boolean)
+				code: error.body?.code
 			});
-			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+			throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 				error: "invalid_saml_response",
 				error_description: error.body?.message || error.message || "Invalid SAML response"
 			}));
 		}
-		ctx.context.logger.error("SAML response binding validation failed", {
-			providerId,
-			error,
-			expectedAudiences: expectedAudiences.filter(Boolean),
-			expectedRecipients: expectedRecipients.filter(Boolean)
-		});
-		throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+		ctx.context.logger.error("SAML response binding validation failed", { providerId });
+		throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 			error: "invalid_saml_response",
 			error_description: "SAML response binding could not be validated"
 		}));
 	}
-	await validateInResponseTo(ctx, {
+	const requestProviderReference = (await validateInResponseTo(ctx, {
 		extract,
 		providerId,
 		options: {
 			enableInResponseToValidation: options?.saml?.enableInResponseToValidation,
 			allowIdpInitiated: options?.saml?.allowIdpInitiated
 		},
-		redirectUrl: samlRedirectUrl
-	});
+		redirectUrl: samlErrorRedirectUrl
+	}))?.providerReference;
+	if (relayStateValidationFailed) throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
+		error: "invalid_state",
+		error_description: "invalid_or_expired_relay_state"
+	}));
+	if (relayState && !stateProviderReference) throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
+		error: "invalid_state",
+		error_description: "sso_provider_reference_missing_or_invalid"
+	}));
+	if (stateProviderReference && requestProviderReference && !isSameSSOProviderReference(stateProviderReference, requestProviderReference)) throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
+		error: "invalid_state",
+		error_description: "sso_provider_reference_mismatch"
+	}));
+	const providerReference = stateProviderReference ?? requestProviderReference ?? await computeSSOProviderReference(provider);
+	if (!await isCurrentSSOProviderReference(provider, providerReference)) throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
+		error: "invalid_state",
+		error_description: "sso_provider_changed_during_authentication"
+	}));
 	validateAudience(ctx, {
 		extract,
 		expectedAudience: parsedSamlConfig.audience || sp.entityMeta.getEntityID(),
 		providerId,
-		redirectUrl: samlRedirectUrl
+		redirectUrl: samlErrorRedirectUrl
 	});
+	const issuer = idp.entityMeta.getEntityID();
 	const assertionId = extractAssertionId(samlBindingContent);
 	if (assertionId) {
-		const issuer = idp.entityMeta.getEntityID();
 		const conditions = extract.conditions;
 		const clockSkew = options?.saml?.clockSkew ?? 3e5;
 		const expiresAt = conditions?.notOnOrAfter ? new Date(conditions.notOnOrAfter).getTime() + clockSkew : Date.now() + DEFAULT_ASSERTION_TTL_MS;
@@ -2402,13 +2903,16 @@ async function processSAMLResponse(ctx, params, options) {
 				issuer,
 				providerId
 			});
-			throw ctx.redirect(buildSAMLRedirectUrl(samlRedirectUrl, {
+			throw ctx.redirect(buildSAMLRedirectUrl(samlErrorRedirectUrl, {
 				error: "replay_detected",
 				error_description: "SAML assertion has already been used"
 			}));
 		}
 	} else ctx.context.logger.warn("Could not extract assertion ID for replay protection", { providerId });
 	const attributes = extract.attributes || {};
+	const providerAttributes = {};
+	for (const [name, value] of Object.entries(attributes)) if (typeof value === "string") providerAttributes[name] = value;
+	else if (Array.isArray(value) && value.every((entry) => typeof entry === "string")) providerAttributes[name] = value;
 	const mapping = parsedSamlConfig.mapping ?? {};
 	const attr = (key) => {
 		const value = attributes[key];
@@ -2416,37 +2920,70 @@ async function processSAMLResponse(ctx, params, options) {
 	};
 	const userInfo = {
 		...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, attributes[value]])),
-		id: attr(mapping.id || "nameID") || extract.nameID,
+		id: extract.nameID,
 		email: (attr(mapping.email || "email") || extract.nameID || "").toLowerCase(),
 		name: [attr(mapping.firstName || "givenName"), attr(mapping.lastName || "surname")].filter(Boolean).join(" ") || attr(mapping.name || "displayName") || extract.nameID,
 		emailVerified: options?.trustEmailVerified && mapping.emailVerified ? parseProviderEmailVerified(attr(mapping.emailVerified)) : false
 	};
 	if (!userInfo.id || !userInfo.email) {
 		ctx.context.logger.error("Missing essential user info from SAML response", {
-			attributes: Object.keys(attributes),
-			mapping,
-			extractedId: userInfo.id,
-			extractedEmail: userInfo.email
+			providerId,
+			attributeNames: Object.keys(attributes),
+			hasNameId: Boolean(userInfo.id),
+			hasEmail: Boolean(userInfo.email)
 		});
 		throw new APIError("BAD_REQUEST", { message: "Unable to extract user ID or email from SAML response" });
 	}
+	const providerUserAttributes = Object.fromEntries(Object.entries(userInfo).filter(([key]) => key !== "id"));
+	const providerUser = {
+		...providerUserAttributes,
+		email: userInfo.email,
+		name: userInfo.name || userInfo.email,
+		image: typeof providerUserAttributes.image === "string" ? providerUserAttributes.image : void 0,
+		emailVerified: userInfo.emailVerified
+	};
+	const accountKey = {
+		issuer,
+		providerAccountId: userInfo.id
+	};
 	const isTrustedProvider = "domainVerified" in provider && !!provider.domainVerified && validateEmailDomain(userInfo.email, provider.domain);
-	const callbackUrl = relayState?.callbackURL || parsedSamlConfig.callbackUrl || ctx.context.baseURL;
-	const errorUrl = relayState?.errorURL || samlRedirectUrl;
+	const callbackUrl = redirectCandidates.some(Boolean) ? samlRedirectUrl : ctx.context.baseURL;
+	const errorUrl = samlErrorRedirectUrl;
 	let result;
 	try {
+		if (options?.resolveUser) {
+			assertSSOUserResolutionNativeTransactionSupport(ctx.context.adapter);
+			assertSSOUserResolutionSessionStorage(ctx.context.options);
+			await assertSSOUserResolutionAsyncContextSupport();
+		}
 		result = await runWithTransaction(ctx.context.adapter, async () => {
 			await lockSSOProviderForAccountLink(ctx, provider);
-			return handleOAuthUserInfo(ctx, {
+			const currentProvider = await findSAMLProvider(providerId, options, await getCurrentAdapter(ctx.context.adapter));
+			if (!currentProvider || !await isCurrentSSOProviderReference(currentProvider, providerReference)) throw new APIError("CONFLICT", {
+				code: "SSO_PROVIDER_CHANGED",
+				message: "SSO provider changed while account linking was in progress"
+			});
+			const resolution = options?.resolveUser ? await resolveSSOUser(options.resolveUser, {
+				protocol: "saml",
+				providerId: provider.providerId,
+				accountKey,
+				providerUser,
+				providerAttributes,
+				providerReference
+			}, await getCurrentAdapter(ctx.context.adapter), ctx.context.logger) : void 0;
+			if (resolution?.action === "reject") throw new APIError("FORBIDDEN", {
+				code: resolution.code,
+				...resolution.message === void 0 ? {} : { message: resolution.message }
+			});
+			const authentication = await handleOAuthUserInfo(ctx, {
 				userInfo: {
-					email: userInfo.email,
-					name: userInfo.name || userInfo.email,
-					id: userInfo.id,
-					emailVerified: userInfo.emailVerified
+					...providerUser,
+					id: userInfo.id
 				},
 				account: {
 					providerId,
-					accountId: userInfo.id,
+					issuer: accountKey.issuer,
+					providerAccountId: accountKey.providerAccountId,
 					accessToken: "",
 					refreshToken: ""
 				},
@@ -2460,15 +2997,26 @@ async function processSAMLResponse(ctx, params, options) {
 					}
 				},
 				isTrustedProvider,
-				trustProviderByName: false
+				trustProviderByName: false,
+				selectedUser: resolution?.action === "link" ? {
+					userId: resolution.userId,
+					profile: resolution.profile
+				} : void 0,
+				deferNonDatabaseWrites: !!options?.resolveUser,
+				requireExactAccountBinding: !!options?.resolveUser
 			});
-		});
+			return options?.resolveUser ? requireSuccessfulSSOAuthentication(authentication) : authentication;
+		}, { onAfterCommitHookError() {
+			ctx.context.logger.error("Committed SSO authentication after-hook failed");
+		} });
 	} catch (e) {
-		if (isAPIError(e) && e.body?.code) throw ctx.redirect(buildSAMLRedirectUrl(errorUrl, {
+		const failedAuthentication = getFailedSSOAuthenticationResult(e);
+		if (failedAuthentication) result = failedAuthentication;
+		else if (isAPIError(e) && e.body?.code) throw ctx.redirect(buildSAMLRedirectUrl(errorUrl, {
 			error: e.body.code,
 			...e.body.message ? { error_description: e.body.message } : {}
 		}));
-		throw e;
+		else throw e;
 	}
 	if (result.error) throw ctx.redirect(buildSAMLRedirectUrl(callbackUrl, { error: result.error.split(" ").join("_") }));
 	const { session, user } = result.data;
@@ -2482,7 +3030,7 @@ async function processSAMLResponse(ctx, params, options) {
 		profile: {
 			providerType: "saml",
 			providerId,
-			accountId: userInfo.id,
+			providerAccountId: userInfo.id,
 			email: userInfo.email,
 			emailVerified: userInfo.emailVerified,
 			rawAttributes: attributes
@@ -2490,6 +3038,7 @@ async function processSAMLResponse(ctx, params, options) {
 		provider,
 		provisioningOptions: options?.organizationProvisioning
 	});
+	if ("accountCookie" in result && result.accountCookie) await setAccountCookie(ctx, result.accountCookie);
 	await setSessionCookie(ctx, {
 		session,
 		user
@@ -2514,7 +3063,7 @@ async function processSAMLResponse(ctx, params, options) {
 			expiresAt: session.expiresAt
 		}).catch((e) => ctx.context.logger.warn("Failed to create SAML session lookup record", e));
 	}
-	return getSafeRedirectUrl(relayState?.callbackURL || parsedSamlConfig.callbackUrl, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	return samlRedirectUrl;
 }
 //#endregion
 //#region src/routes/sso.ts
@@ -2660,10 +3209,6 @@ const registerSSOProvider = (options) => {
 										type: "object",
 										nullable: true,
 										properties: {
-											id: {
-												type: "string",
-												description: "Field mapping for user ID (defaults to 'sub')"
-											},
 											email: {
 												type: "string",
 												description: "Field mapping for email (defaults to 'email')"
@@ -2689,11 +3234,7 @@ const registerSSOProvider = (options) => {
 												description: "Additional field mappings"
 											}
 										},
-										required: [
-											"id",
-											"email",
-											"name"
-										]
+										required: ["email", "name"]
 									}
 								},
 								required: [
@@ -2750,9 +3291,10 @@ const registerSSOProvider = (options) => {
 		})).length >= limit) throw new APIError("FORBIDDEN", { message: "You have reached the maximum number of SSO providers" });
 		const body = ctx.body;
 		const additionalFields = parseSSOProviderAdditionalFields(options, body, "create");
-		if (body.samlConfig?.idpMetadata?.metadata) {
+		if (body.samlConfig) {
 			const maxMetadataSize = options?.saml?.maxMetadataSize ?? 102400;
-			if (new TextEncoder().encode(body.samlConfig.idpMetadata.metadata).length > maxMetadataSize) throw new APIError("BAD_REQUEST", { message: `IdP metadata exceeds maximum allowed size (${maxMetadataSize} bytes)` });
+			assertSAMLMetadataSize(body.samlConfig.idpMetadata?.metadata, "IdP", maxMetadataSize);
+			assertSAMLMetadataSize(body.samlConfig.spMetadata?.metadata, "SP", maxMetadataSize);
 		}
 		if (ctx.body.organizationId) {
 			const member = await ctx.context.adapter.findOne({
@@ -2768,28 +3310,16 @@ const registerSSOProvider = (options) => {
 			if (!member) throw new APIError("BAD_REQUEST", { message: "You are not a member of the organization" });
 			if (ctx.context.hasPlugin("organization") && !hasOrgAdminRole(member)) throw new APIError("FORBIDDEN", { message: "You must be an organization owner or admin to register SSO providers" });
 		}
-		if (new Set([
+		if ((/* @__PURE__ */ new Set([
 			...BUILT_IN_ACCOUNT_PROVIDER_IDS,
 			...Object.keys(ctx.context.options.socialProviders ?? {}),
 			...ctx.context.socialProviders.map((p) => p.id),
 			...ctx.context.trustedProviders,
 			...options?.defaultSSO?.map((p) => p.providerId) ?? []
-		]).has(body.providerId)) {
+		])).has(body.providerId)) {
 			ctx.context.logger.warn(`SSO provider registration rejected for reserved providerId: ${body.providerId}`);
 			throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is reserved and cannot be used for an SSO provider" });
 		}
-		if (ctx.context.hasPlugin("scim")) {
-			if (await ctx.context.adapter.findOne({
-				model: "scimProvider",
-				where: [{
-					field: "providerId",
-					value: body.providerId
-				}]
-			})) {
-				ctx.context.logger.warn(`SSO provider registration rejected for SCIM providerId: ${body.providerId}`);
-				throw new APIError("UNPROCESSABLE_ENTITY", { message: "This providerId is already used by a SCIM provider and cannot be used for an SSO provider" });
-			}
-		}
 		if (await ctx.context.adapter.findOne({
 			model: "ssoProvider",
 			where: [{
@@ -2868,6 +3398,11 @@ const registerSSOProvider = (options) => {
 				digestAlgorithm: body.samlConfig.digestAlgorithm
 			}, options?.saml?.algorithms);
 			validateCertSources(body.samlConfig);
+			assertSAMLIdentityProviderAuthority(body.samlConfig);
+			assertSAMLServiceProviderMetadataPolicy({
+				...body.samlConfig,
+				issuer: body.issuer
+			});
 			const hasIdpMetadata = body.samlConfig.idpMetadata?.metadata;
 			let hasEntryPoint = false;
 			if (body.samlConfig.entryPoint) try {
@@ -2899,6 +3434,7 @@ const registerSSOProvider = (options) => {
 					cert: body.samlConfig.cert,
 					audience: body.samlConfig.audience,
 					callbackUrl: body.samlConfig.callbackUrl,
+					idpInitiatedCallbackUrl: body.samlConfig.idpInitiatedCallbackUrl,
 					idpMetadata: body.samlConfig.idpMetadata,
 					spMetadata: body.samlConfig.spMetadata,
 					wantAssertionsSigned: body.samlConfig.wantAssertionsSigned,
@@ -3107,7 +3643,7 @@ const signInSSO = (options) => {
 				throw error;
 			}
 			if (!config.authorizationEndpoint) throw new APIError("BAD_REQUEST", { message: "Invalid OIDC configuration. Authorization URL not found." });
-			if (options?.redirectURI?.trim()) await addOAuthServerContext({ ssoProviderId: provider.providerId });
+			await addOAuthServerContext({ [SSO_PROVIDER_STATE_KEY]: await computeSSOProviderReference(provider) });
 			const state = await generateState(ctx);
 			const redirectURI = getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options);
 			const authorizationURL = await createAuthorizationURL({
@@ -3139,7 +3675,8 @@ const signInSSO = (options) => {
 			const parsedSamlConfig = typeof provider.samlConfig === "object" ? provider.samlConfig : safeJsonParse(provider.samlConfig);
 			if (!parsedSamlConfig) throw new APIError("BAD_REQUEST", { message: "Invalid SAML configuration" });
 			if (parsedSamlConfig.authnRequestsSigned && !parsedSamlConfig.spMetadata?.privateKey && !parsedSamlConfig.privateKey) throw new APIError("BAD_REQUEST", { message: "authnRequestsSigned is enabled but no privateKey provided in spMetadata or samlConfig" });
-			const { state: relayState } = await generateRelayState(ctx, void 0);
+			const providerReference = await computeSSOProviderReference(provider);
+			const { state: relayState } = await generateRelayState(ctx, void 0, providerReference);
 			const sp = createSP(parsedSamlConfig, ctx.context.baseURL, provider.providerId, { relayState });
 			const idp = createIdP(parsedSamlConfig);
 			const loginRequest = sp.createLoginRequest(idp, "redirect");
@@ -3149,6 +3686,7 @@ const signInSSO = (options) => {
 				const record = {
 					id: loginRequest.id,
 					providerId: provider.providerId,
+					providerReference,
 					createdAt: Date.now(),
 					expiresAt: Date.now() + ttl
 				};
@@ -3196,13 +3734,14 @@ function getOIDCErrorDescription(error, fallback) {
 * @param stateData - Pre-parsed state data. If not provided, it will be
 *   parsed from the request context.
 */
-async function handleOIDCCallback(ctx, options, providerId, stateData) {
+async function handleOIDCCallback(ctx, options, providerId, stateData, parsedProviderReference) {
 	const { code, error, error_description } = ctx.query;
 	if (!stateData) stateData = await parseState(ctx);
 	if (!stateData) {
 		const errorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
 		throw ctx.redirect(`${errorURL}?error=invalid_state`);
 	}
+	const providerReference = parsedProviderReference ?? parseSSOProviderReference(stateData.serverContext?.["ssoProviderReference"]);
 	const { callbackURL, errorURL, newUserURL, requestSignUp } = stateData;
 	const redirectOIDCError = (error, description) => {
 		const baseURL = errorURL || callbackURL;
@@ -3216,6 +3755,8 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 	if (!code || error) redirectOIDCError(error || "invalid_request", error_description || (error ? error : "authorization_code_not_found"));
 	const provider = await resolveOIDCProvider(ctx, options, providerId);
 	if (!provider) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=provider not found`);
+	const acceptedProviderReference = providerReference ?? redirectOIDCError("invalid_state", "missing_sso_provider_reference");
+	if (!await isCurrentSSOProviderReference(provider, acceptedProviderReference)) redirectOIDCError("invalid_state", "sso_provider_changed_during_authentication");
 	if (options?.domainVerification?.enabled && !("domainVerified" in provider && provider.domainVerified)) throw new APIError("UNAUTHORIZED", { message: "Provider domain has not been verified" });
 	let config = provider.oidcConfig;
 	if (!config) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=provider not found`);
@@ -3287,7 +3828,28 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 	if (!tokenResponse) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_response_not_found`);
 	let userInfo = null;
 	const mapping = config.mapping || {};
+	const readStringClaim = (claims, claim) => {
+		const value = claims[claim];
+		return typeof value === "string" && value.length > 0 ? value : void 0;
+	};
 	let rawProfile;
+	let verifiedIdToken = null;
+	if (tokenResponse.idToken) {
+		const jwksEndpoint = config.jwksEndpoint;
+		if (!jwksEndpoint) redirectOIDCError("invalid_provider", "jwks_endpoint_not_found");
+		const verified = await validateOIDCIdToken(tokenResponse.idToken, jwksEndpoint, {
+			audience: config.clientId,
+			issuer: provider.issuer
+		}, (url) => ctx.context.isTrustedOrigin(url)).catch((error) => {
+			if (error instanceof DiscoveryError) redirectOIDCError("invalid_provider", error.message);
+			ctx.context.logger.error(error);
+			return null;
+		});
+		if (!verified) redirectOIDCError("invalid_provider", "token_not_verified");
+		if (!readStringClaim(verified.payload, "sub")) redirectOIDCError("invalid_provider", "id_token_subject_missing");
+		verifiedIdToken = verified;
+	}
+	if (options?.resolveUser && !verifiedIdToken) redirectOIDCError("invalid_provider", "id_token_required_for_user_resolution");
 	if (config.userInfoEndpoint) {
 		const userInfoResponse = await fetchOIDCEndpoint("userInfoEndpoint", config.userInfoEndpoint, { headers: { Authorization: `Bearer ${tokenResponse.accessToken}` } }, (url) => ctx.context.isTrustedOrigin(url)).catch((e) => {
 			if (e instanceof DiscoveryError) redirectOIDCError("invalid_provider", e.message);
@@ -3295,58 +3857,85 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		});
 		if (userInfoResponse.error) redirectOIDCError("invalid_provider", userInfoResponse.error.message || userInfoResponse.error.statusText || "userinfo_response_error");
 		const rawUserInfo = userInfoResponse.data ?? redirectOIDCError("invalid_provider", "userinfo_response_not_found");
+		if (verifiedIdToken && rawUserInfo.sub !== verifiedIdToken.payload.sub) redirectOIDCError("invalid_provider", "id_token_userinfo_subject_mismatch");
 		rawProfile = rawUserInfo;
 		userInfo = {
 			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, rawUserInfo[value]])),
-			id: rawUserInfo[mapping.id || "sub"],
-			email: rawUserInfo[mapping.email || "email"],
+			id: readStringClaim(rawUserInfo, "sub"),
+			email: readStringClaim(rawUserInfo, mapping.email || "email"),
 			emailVerified: options?.trustEmailVerified ? parseProviderEmailVerified(rawUserInfo[mapping.emailVerified || "email_verified"]) : false,
-			name: rawUserInfo[mapping.name || "name"],
-			image: rawUserInfo[mapping.image || "picture"]
+			name: readStringClaim(rawUserInfo, mapping.name || "name"),
+			image: readStringClaim(rawUserInfo, mapping.image || "picture")
 		};
-	} else if (tokenResponse.idToken) {
-		const idToken = decodeJwt(tokenResponse.idToken);
+	} else if (verifiedIdToken) {
+		const idToken = verifiedIdToken.payload;
 		rawProfile = idToken;
-		if (!config.jwksEndpoint) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=jwks_endpoint_not_found`);
-		const verified = await validateOIDCIdToken(tokenResponse.idToken, config.jwksEndpoint, {
-			audience: config.clientId,
-			issuer: provider.issuer
-		}, (url) => ctx.context.isTrustedOrigin(url)).catch((e) => {
-			if (e instanceof DiscoveryError) redirectOIDCError("invalid_provider", e.message);
-			ctx.context.logger.error(e);
-			return null;
-		});
-		if (!verified) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=token_not_verified`);
 		userInfo = {
-			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, verified.payload[value]])),
-			id: idToken[mapping.id || "sub"],
-			email: idToken[mapping.email || "email"],
+			...Object.fromEntries(Object.entries(mapping.extraFields || {}).map(([key, value]) => [key, idToken[value]])),
+			id: idToken.sub,
+			email: readStringClaim(idToken, mapping.email || "email"),
 			emailVerified: options?.trustEmailVerified ? parseProviderEmailVerified(idToken[mapping.emailVerified || "email_verified"]) : false,
-			name: idToken[mapping.name || "name"],
-			image: idToken[mapping.image || "picture"]
+			name: readStringClaim(idToken, mapping.name || "name"),
+			image: readStringClaim(idToken, mapping.image || "picture")
 		};
 	} else throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=user_info_endpoint_not_found`);
 	if (!userInfo.email || !userInfo.id) throw ctx.redirect(`${errorURL || callbackURL}?error=invalid_provider&error_description=missing_user_info`);
 	const userInfoEmail = userInfo.email;
 	const userInfoId = userInfo.id;
+	const providerUser = {
+		...Object.fromEntries(Object.entries(userInfo).filter(([key]) => key !== "id")),
+		email: userInfoEmail,
+		name: typeof userInfo.name === "string" ? userInfo.name : "",
+		image: typeof userInfo.image === "string" ? userInfo.image : void 0,
+		emailVerified: options?.trustEmailVerified ? userInfo.emailVerified === true : false
+	};
+	const accountKey = {
+		issuer: verifiedIdToken && readStringClaim(verifiedIdToken.payload, "iss") || provider.issuer,
+		providerAccountId: userInfoId
+	};
 	const isTrustedProvider = "domainVerified" in provider && provider.domainVerified === true && validateEmailDomain(userInfoEmail, provider.domain);
 	let linked;
 	try {
+		if (options?.resolveUser) {
+			assertSSOUserResolutionNativeTransactionSupport(ctx.context.adapter);
+			assertSSOUserResolutionSessionStorage(ctx.context.options);
+			await assertSSOUserResolutionAsyncContextSupport();
+		}
 		linked = await runWithTransaction(ctx.context.adapter, async () => {
 			await lockSSOProviderForAccountLink(ctx, provider);
-			return handleOAuthUserInfo(ctx, {
+			const currentProvider = await resolveOIDCProvider(ctx, options, providerId, await getCurrentAdapter(ctx.context.adapter));
+			if (!currentProvider || !await isCurrentSSOProviderReference(currentProvider, acceptedProviderReference)) throw new APIError("CONFLICT", {
+				code: "SSO_PROVIDER_CHANGED",
+				message: "SSO provider changed while account linking was in progress"
+			});
+			const resolution = options?.resolveUser ? await resolveSSOUser(options.resolveUser, {
+				protocol: "oidc",
+				providerId: provider.providerId,
+				accountKey,
+				providerUser,
+				providerClaims: rawProfile ?? {},
+				verifiedIdTokenClaims: verifiedIdToken?.payload ?? {},
+				providerReference: acceptedProviderReference
+			}, await getCurrentAdapter(ctx.context.adapter), ctx.context.logger) : void 0;
+			if (resolution?.action === "reject") throw new APIError("FORBIDDEN", {
+				code: resolution.code,
+				...resolution.message === void 0 ? {} : { message: resolution.message }
+			});
+			const authentication = await handleOAuthUserInfo(ctx, {
 				userInfo: {
-					email: userInfoEmail,
-					name: userInfo.name || "",
+					...providerUser,
+					email: providerUser.email,
+					name: providerUser.name,
 					id: userInfoId,
-					image: userInfo.image,
-					emailVerified: options?.trustEmailVerified ? userInfo.emailVerified || false : false
+					image: providerUser.image,
+					emailVerified: providerUser.emailVerified
 				},
 				account: {
 					idToken: tokenResponse.idToken,
 					accessToken: tokenResponse.accessToken,
 					refreshToken: tokenResponse.refreshToken,
-					accountId: userInfoId,
+					issuer: accountKey.issuer,
+					providerAccountId: userInfoId,
 					providerId: provider.providerId,
 					accessTokenExpiresAt: tokenResponse.accessTokenExpiresAt,
 					refreshTokenExpiresAt: tokenResponse.refreshTokenExpiresAt,
@@ -3363,18 +3952,28 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 					}
 				},
 				isTrustedProvider,
-				trustProviderByName: false
+				trustProviderByName: false,
+				selectedUser: resolution?.action === "link" ? {
+					userId: resolution.userId,
+					profile: resolution.profile
+				} : void 0,
+				deferNonDatabaseWrites: !!options?.resolveUser,
+				requireExactAccountBinding: !!options?.resolveUser
 			});
-		});
+			return options?.resolveUser ? requireSuccessfulSSOAuthentication(authentication) : authentication;
+		}, { onAfterCommitHookError(error) {
+			ctx.context.logger.error("Committed SSO authentication after-hook failed", error);
+		} });
 	} catch (e) {
-		if (isAPIError(e) && e.body?.code) {
+		const failedAuthentication = getFailedSSOAuthenticationResult(e);
+		if (failedAuthentication) linked = failedAuthentication;
+		else if (isAPIError(e) && e.body?.code) {
 			const baseURL = errorURL || callbackURL;
 			const params = new URLSearchParams({ error: e.body.code });
 			if (e.body.message) params.set("error_description", e.body.message);
 			const sep = baseURL.includes("?") ? "&" : "?";
 			throw ctx.redirect(`${baseURL}${sep}${params.toString()}`);
-		}
-		throw e;
+		} else throw e;
 	}
 	if (linked.error) {
 		const baseURL = errorURL || callbackURL;
@@ -3394,7 +3993,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		profile: {
 			providerType: "oidc",
 			providerId: provider.providerId,
-			accountId: userInfoId,
+			providerAccountId: userInfoId,
 			email: userInfoEmail,
 			emailVerified: Boolean(userInfo.emailVerified),
 			rawAttributes: userInfo
@@ -3403,6 +4002,7 @@ async function handleOIDCCallback(ctx, options, providerId, stateData) {
 		token: tokenResponse,
 		provisioningOptions: options?.organizationProvisioning
 	});
+	if ("accountCookie" in linked && linked.accountCookie) await setAccountCookie(ctx, linked.accountCookie);
 	await setSessionCookie(ctx, {
 		session,
 		user
@@ -3434,7 +4034,7 @@ const callbackSSOEndpointConfig = {
 * and falling back to the `ssoProvider` table. Returns `null` when no match is
 * found so the caller can decide how to react (redirect, silently skip, etc.).
 */
-async function resolveOIDCProvider(ctx, options, providerId) {
+async function resolveOIDCProvider(ctx, options, providerId, adapter = ctx.context.adapter) {
 	const matchingDefault = options?.defaultSSO?.find((defaultProvider) => defaultProvider.providerId === providerId);
 	if (matchingDefault) return {
 		...matchingDefault,
@@ -3442,7 +4042,7 @@ async function resolveOIDCProvider(ctx, options, providerId) {
 		userId: "default",
 		...options?.domainVerification?.enabled ? { domainVerified: true } : {}
 	};
-	return ctx.context.adapter.findOne({
+	return adapter.findOne({
 		model: "ssoProvider",
 		where: [{
 			field: "providerId",
@@ -3482,7 +4082,7 @@ async function bounceIfIdpInitiated(ctx, options, providerId) {
 		});
 		return;
 	}
-	if (options?.redirectURI?.trim()) await addOAuthServerContext({ ssoProviderId: provider.providerId });
+	await addOAuthServerContext({ [SSO_PROVIDER_STATE_KEY]: await computeSSOProviderReference(provider) });
 	const state = await generateState(ctx);
 	const redirectURI = getOIDCRedirectURI(ctx.context.baseURL, provider.providerId, options);
 	const authorizationURL = await createAuthorizationURL({
@@ -3534,12 +4134,12 @@ const callbackSSOShared = (options) => {
 			const errorURL = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
 			throw ctx.redirect(`${errorURL}?error=invalid_state`);
 		}
-		const providerId = stateData.serverContext?.ssoProviderId;
-		if (!providerId) {
+		const providerReference = parseSSOProviderReference(stateData.serverContext?.[SSO_PROVIDER_STATE_KEY]);
+		if (!providerReference) {
 			const errorURL = stateData.errorURL || stateData.callbackURL;
-			throw ctx.redirect(`${errorURL}?error=invalid_state&error_description=missing_provider_id`);
+			throw ctx.redirect(`${errorURL}?error=invalid_state&error_description=missing_sso_provider_reference`);
 		}
-		return handleOIDCCallback(ctx, options, providerId, stateData);
+		return handleOIDCCallback(ctx, options, providerReference.providerId, stateData, providerReference);
 	});
 };
 const acsEndpointBodySchema = z.object({
@@ -3569,13 +4169,14 @@ const acsEndpoint = (options) => {
 		const { providerId } = ctx.params;
 		const currentCallbackPath = `${ctx.context.baseURL}/sso/saml2/sp/acs/${providerId}`;
 		const appOrigin = new URL(ctx.context.baseURL).origin;
+		let resolvedErrorRedirectUrl;
 		if (ctx.method === "GET" && !ctx.body?.SAMLResponse) {
 			if (!(await getSessionFromCtx(ctx))?.session) {
 				const errorURL = ctx.context.options.onAPIError?.errorURL || `${appOrigin}/error`;
 				throw ctx.redirect(`${errorURL}?error=invalid_request`);
 			}
 			const relayState = ctx.query?.RelayState;
-			throw ctx.redirect(getSafeRedirectUrl(relayState, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings)));
+			throw ctx.redirect(getSafeRedirectUrl([relayState], currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings)));
 		}
 		if (!ctx.body?.SAMLResponse) throw new APIError("BAD_REQUEST", { message: "SAMLResponse is required for POST requests" });
 		try {
@@ -3583,15 +4184,33 @@ const acsEndpoint = (options) => {
 				SAMLResponse: ctx.body.SAMLResponse,
 				RelayState: ctx.body.RelayState,
 				providerId,
-				currentCallbackPath
+				currentCallbackPath,
+				onErrorRedirectResolved: (url) => {
+					resolvedErrorRedirectUrl = url;
+				}
 			}, options);
 			throw ctx.redirect(safeRedirectUrl);
 		} catch (error) {
 			if (error instanceof Response || error && typeof error === "object" && "status" in error && error.status === 302) throw error;
 			if (error instanceof APIError && error.statusCode === 400) {
 				const errorCode = (error.body?.code || "saml_error").toLowerCase();
-				const redirectUrl = getSafeRedirectUrl(ctx.body?.RelayState || void 0, currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
-				throw ctx.redirect(`${redirectUrl}${redirectUrl.includes("?") ? "&" : "?"}error=${encodeURIComponent(errorCode)}&error_description=${encodeURIComponent(error.message)}`);
+				let redirectUrl = resolvedErrorRedirectUrl;
+				if (!redirectUrl) {
+					let parsedSamlConfig;
+					try {
+						parsedSamlConfig = (await findSAMLProvider(providerId, options, ctx.context.adapter))?.samlConfig;
+					} catch (providerLookupError) {
+						ctx.context.logger.warn("Failed to resolve SAML provider for error redirect", {
+							providerId,
+							error: providerLookupError
+						});
+					}
+					redirectUrl = getSafeRedirectUrl(getSAMLRedirectCandidates(void 0, parsedSamlConfig, options?.saml), currentCallbackPath, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+				}
+				throw ctx.redirect(buildSAMLRedirectUrl(redirectUrl, {
+					error: errorCode,
+					error_description: error.message
+				}));
 			}
 			throw error;
 		}
@@ -3620,7 +4239,7 @@ const sloEndpoint = (options) => {
 		const samlResponse = ctx.body?.SAMLResponse || ctx.query?.SAMLResponse;
 		const relayState = ctx.body?.RelayState || ctx.query?.RelayState;
 		const appOrigin = new URL(ctx.context.baseURL).origin;
-		const safeErrorURL = getSafeRedirectUrl(relayState, `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+		const safeErrorURL = getSafeRedirectUrl([relayState], `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 		if (!samlRequest && !samlResponse) throw ctx.redirect(`${safeErrorURL}?error=invalid_request&error_description=missing_logout_data`);
 		const provider = await findSAMLProvider(providerId, options, ctx.context.adapter);
 		if (!provider?.samlConfig) throw APIError.from("NOT_FOUND", SAML_ERROR_CODES.SAML_PROVIDER_NOT_FOUND);
@@ -3660,7 +4279,7 @@ async function handleLogoutResponse(ctx, sp, idp, relayState, providerId) {
 	}
 	deleteSessionCookie(ctx);
 	const appOrigin = new URL(ctx.context.baseURL).origin;
-	const safeRedirectUrl = getSafeRedirectUrl(relayState, `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
+	const safeRedirectUrl = getSafeRedirectUrl([relayState], `${appOrigin}/sso/saml2/sp/slo/${providerId}`, appOrigin, (url, settings) => ctx.context.isTrustedOrigin(url, settings));
 	throw ctx.redirect(safeRedirectUrl);
 }
 async function handleLogoutRequest(ctx, sp, idp, relayState, providerId) {
@@ -3814,7 +4433,7 @@ function sso(options) {
 		listSSOProviders: listSSOProviders(optionsWithStore),
 		getSSOProvider: getSSOProvider(optionsWithStore),
 		updateSSOProvider: updateSSOProvider(optionsWithStore),
-		deleteSSOProvider: deleteSSOProvider()
+		deleteSSOProvider: deleteSSOProvider(optionsWithStore)
 	};
 	if (options?.domainVerification?.enabled) {
 		const domainVerificationEndpoints = {
@@ -3923,4 +4542,4 @@ function sso(options) {
 	};
 }
 //#endregion
-export { DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DigestAlgorithm, DiscoveryError, KeyEncryptionAlgorithm, REQUIRED_DISCOVERY_FIELDS, SignatureAlgorithm, computeDiscoveryUrl, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };
+export { DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_SAML_METADATA_SIZE, DEFAULT_MAX_SAML_RESPONSE_SIZE, DataEncryptionAlgorithm, DigestAlgorithm, DiscoveryError, KeyEncryptionAlgorithm, REQUIRED_DISCOVERY_FIELDS, SignatureAlgorithm, computeDiscoveryUrl, deriveSAMLIdentityProviderEntityID, deriveSAMLServiceProviderPolicy, discoverOIDCConfig, fetchDiscoveryDocument, needsRuntimeDiscovery, normalizeDiscoveryUrls, normalizeUrl, selectTokenEndpointAuthMethod, sso, validateDiscoveryDocument, validateDiscoveryUrl, validateSAMLTimestamp };