supabase / auth / 42210782111

72%

Build Type

push

github

Committed by web-flow

Commit Message

feat(saml): add dedicated_scope option for SAML providers (#2893)

Some SAML identity providers (famously Entra) don't allow the same
entity ID to be registered with multiple "applications," making Supabase
Auth usable only with one application. Some enterprise use-cases are
therefore hard to build.

In this PR we add a `dedicated_scope` optional boolean on an SSO
provider, which in SAML means that the provider can only be used via its
own new Entity ID and URLs scoped to the provider's unique ID.

| Dedicated scope | Entity ID, Metadata URL | ACS URL |
| -- | -- | -- |
| False or Null | /sso/saml/metadata | /sso//saml/acs |
| True | /sso/{uuid}/saml/metadata | /sso/{uuid}/saml/acs |

This way in Entra you can register many SPs served by the same Supabase
Auth project by creating them with the `dedicated_scope` boolean.

Notes:

- Adds a `dedicated_scope` boolean to SAML SSO providers. When set, that
provider's ACS URL and SP metadata URL (and, by extension, the entity ID
GoTrue presents to the IdP, which defaults to the metadata URL) are
scoped to the provider's own ID, instead of using the URLs shared by
every SAML provider in the project. The same signing key/certificate is
still used.
- Useful for IdPs that require a unique ACS URL/entity ID per
connection, and isolates assertions issued for one connection from being
replayed against another.
- New dedicated routes `GET /sso/{sso_provider_id}/saml/metadata` and
`POST /sso/{sso_provider_id}/saml/acs` alongside the existing shared
`/sso/saml/*` endpoints; the ACS handler rejects a provider hitting the
wrong endpoint for its scope setting.
- `dedicated_scope` can be set on create/update via the admin SSO
provider API and is documented in `openapi.yaml`.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Cemal Kilic <cemalkilic96@gmail.com>
Co-authored-by: Cemal Kılıç <cemalkilic@users.noreply.github.com>

Coverage Stats

29 of 65 new or added lines in 6 files covered. (44.62%)

1 existing line in 1 file now uncovered.

16822 of 23468 relevant lines covered (71.68%)

516.68 hits per line