supabase / auth
72%

DEFAULT BRANCH: master
Repo Added
Token 1T31V1W6OkCUSHigZiCz5dLEn3wnbRdrc regen
Build 2657 Last
Files 208
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: master
CHANGE BRANCH
x
Sync Branches

coverage: 71.681% (-0.05%) from 71.732%
42210782111

push

github

web-flow 
feat(saml): add dedicated_scope option for SAML providers (#2893)

Some SAML identity providers (famously Entra) don't allow the same
entity ID to be registered with multiple "applications," making Supabase
Auth usable only with one application. Some enterprise use-cases are
therefore hard to build.

In this PR we add a `dedicated_scope` optional boolean on an SSO
provider, which in SAML means that the provider can only be used via its
own new Entity ID and URLs scoped to the provider's unique ID.

| Dedicated scope | Entity ID, Metadata URL | ACS URL |
| -- | -- | -- |
| False or Null | /sso/saml/metadata | /sso//saml/acs |
| True | /sso/{uuid}/saml/metadata | /sso/{uuid}/saml/acs |

This way in Entra you can register many SPs served by the same Supabase
Auth project by creating them with the `dedicated_scope` boolean.

Notes:

- Adds a `dedicated_scope` boolean to SAML SSO providers. When set, that
provider's ACS URL and SP metadata URL (and, by extension, the entity ID
GoTrue presents to the IdP, which defaults to the metadata URL) are
scoped to the provider's own ID, instead of using the URLs shared by
every SAML provider in the project. The same signing key/certificate is
still used.
- Useful for IdPs that require a unique ACS URL/entity ID per
connection, and isolates assertions issued for one connection from being
replayed against another.
- New dedicated routes `GET /sso/{sso_provider_id}/saml/metadata` and
`POST /sso/{sso_provider_id}/saml/acs` alongside the existing shared
`/sso/saml/*` endpoints; the ACS handler rejects a provider hitting the
wrong endpoint for its scope setting.
- `dedicated_scope` can be set on create/update via the admin SSO
provider API and is documented in `openapi.yaml`.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Cemal Kilic <cemalkilic96@gmail.com>
Co-authored-by: Cemal Kılıç <cemalkilic@users.noreply.github.com>

29 of 65 new or added lines in 6 files covered. (44.62%)

1 existing line in 1 file now uncovered.

16822 of 23468 relevant lines covered (71.68%)

516.68 hits per line

Relevant lines Covered
23468 RELEVANT LINES 16822 COVERED LINES
516.68 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
42210782111 master feat(saml): add dedicated_scope option for SAML providers (#2893) Some SAML identity providers (famously Entra) don't allow the same entity ID to be registered with multiple "applications," making Supabase Auth usable only with one application. S... push web-flow github
71.68
42208824384 master fix(vulncheck): ignore GO-2026-6909 (crewjam/saml, no fix available) (#2909) ## What Adds `GO-2026-6909` to the `vulncheck-filter` ignore map so `make vulncheck` passes again. It currently fails on every branch (e.g. #2893). ## Why it's safe to... push web-flow github
71.73
41701485687 master feat: min password length uses runes, not bytes (#2879) ## What `checkPasswordStrength` compared `len(password)` (bytes) against `Password.MinLength`. It now uses `utf8.RuneCountInString`, matching the \"at least N characters\" message. Same bug ... push web-flow github
71.69
41681910795 master docs: fix openapi response for DELETE /admin/users/{userId} (#2874) <!-- claude-slack-attribution --> _Requested by **Cemal Kilic** · [Slack thread](https://supabase.slack.com/archives/C022071RB2L/p1791968272007429?thread_ts=1791968272.007429&cid... push web-flow github
71.69
41681861952 master fix: restrict OAuth client access tokens to OAuth endpoints (#2898) ## What Access tokens issued by the OAuth 2.1 server (sessions with `oauth_client_id` set) are now only accepted on endpoints intended for OAuth clients. Today that's only `GET ... push web-flow github
71.69
41649064774 master fix(models): exclude oauth client sessions from mfa step-up invalidation (#2801) (#2802) ## What kind of change does this PR introduce? Bug fix. ## What is the current behavior? Closes #2801. When a user completes an MFA verification (`verify... push web-flow github
71.66
41647899148 master fix: assert password is rejected after magic link/OTP (#2896) ## What kind of change does this PR introduce? Bug fix (test only) ## What is the current behavior? `TestOtp/TestOtpClearsUnconfirmedPassword` and `TestOtp/TestOtpClearsUnconfirmedP... push web-flow github
71.66
41032383523 master feat: clear existing password on recover (#2887) ## What kind of change does this PR introduce? Bug fix ## What is the current behavior? A password set on an unconfirmed account would remain valid if the account was verified through a linked s... push web-flow github
71.73
41023936772 master fix(linkedin): avoid panic when the email response has no elements GetUserData indexed e.Elements[0] without checking the slice length. When LinkedIn's /v2/emailAddress endpoint returns an empty elements array (for example when the email scope is... push hf github
71.69
40786946272 master docs: Add SECURITY.md (#2884) ## What kind of change does this PR introduce? Adds a SECURITY.md file so we can get better signal on our security reports. ## What is the current behavior? Agents and researchers send us reports that are invalid ... push web-flow github
71.67
See All Builds (2655)

Badge your Repo: auth

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh