BA
Better Auth•2mo ago
Shifty

SSO Sign In does not handle redirect to callbackUrl set in function

const handleSSOSignIn = async () => {
    try {
      await authClient.signIn.sso({
        organizationSlug: orgSlug,
        callbackURL: '/select-organization'
      })
    } catch (error) {
      console.error('SSO sign-in error:', error)
      form.setError('root', { message: 'Failed to sign in with SSO' })
    }
  }
const handleSSOSignIn = async () => {
    try {
      await authClient.signIn.sso({
        organizationSlug: orgSlug,
        callbackURL: '/select-organization'
      })
    } catch (error) {
      console.error('SSO sign-in error:', error)
      form.setError('root', { message: 'Failed to sign in with SSO' })
    }
  }
redirects to http://localhost:3000/api/auth/sso/saml2/callback/<providerId> with this json: {"redirect":true,"url":"https://login.microsoftonline.com/<tenantId>/saml2/dashboard"}
1 Reply
Shifty
ShiftyOP•2mo ago
if (provider.samlConfig) {
                        const parsedSamlConfig = JSON.parse(
                            provider.samlConfig as unknown as string,
                        );
                        const sp = saml.ServiceProvider({
                            metadata: parsedSamlConfig.spMetadata.metadata,
                            allowCreate: true,
                        });
                        const idp = saml.IdentityProvider({
                            metadata: parsedSamlConfig.idpMetadata.metadata,
                        });
                        const loginRequest = sp.createLoginRequest(
                            idp,
                            "redirect",
                        ) as BindingContext & { entityEndpoint: string; type: string };
                        if (!loginRequest) {
                            throw new APIError("BAD_REQUEST", {
                                message: "Invalid SAML request",
                            });
                        }
                        return ctx.json({
                            url: `${loginRequest.context}&RelayState=${encodeURIComponent(
                                body.callbackURL,
                            )}`,
                            redirect: true,
                        });
                    }
if (provider.samlConfig) {
                        const parsedSamlConfig = JSON.parse(
                            provider.samlConfig as unknown as string,
                        );
                        const sp = saml.ServiceProvider({
                            metadata: parsedSamlConfig.spMetadata.metadata,
                            allowCreate: true,
                        });
                        const idp = saml.IdentityProvider({
                            metadata: parsedSamlConfig.idpMetadata.metadata,
                        });
                        const loginRequest = sp.createLoginRequest(
                            idp,
                            "redirect",
                        ) as BindingContext & { entityEndpoint: string; type: string };
                        if (!loginRequest) {
                            throw new APIError("BAD_REQUEST", {
                                message: "Invalid SAML request",
                            });
                        }
                        return ctx.json({
                            url: `${loginRequest.context}&RelayState=${encodeURIComponent(
                                body.callbackURL,
                            )}`,
                            redirect: true,
                        });
                    }
if (provider.oidcConfig && body.providerType !== "saml") {
                        const state = await generateState(ctx);
                        const redirectURI = `${ctx.context.baseURL}/sso/callback/${provider.providerId}`;
                        const authorizationURL = await createAuthorizationURL({
                            id: provider.issuer,
                            options: {
                                clientId: provider.oidcConfig.clientId,
                                clientSecret: provider.oidcConfig.clientSecret,
                            },
                            redirectURI,
                            state: state.state,
                            codeVerifier: provider.oidcConfig.pkce
                                ? state.codeVerifier
                                : undefined,
                            scopes: ctx.body.scopes || [
                                "openid",
                                "email",
                                "profile",
                                "offline_access",
                            ],
                            authorizationEndpoint: provider.oidcConfig.authorizationEndpoint,
                        });
                        return ctx.json({
                            url: authorizationURL.toString(),
                            redirect: true,
                        });
                    }
if (provider.oidcConfig && body.providerType !== "saml") {
                        const state = await generateState(ctx);
                        const redirectURI = `${ctx.context.baseURL}/sso/callback/${provider.providerId}`;
                        const authorizationURL = await createAuthorizationURL({
                            id: provider.issuer,
                            options: {
                                clientId: provider.oidcConfig.clientId,
                                clientSecret: provider.oidcConfig.clientSecret,
                            },
                            redirectURI,
                            state: state.state,
                            codeVerifier: provider.oidcConfig.pkce
                                ? state.codeVerifier
                                : undefined,
                            scopes: ctx.body.scopes || [
                                "openid",
                                "email",
                                "profile",
                                "offline_access",
                            ],
                            authorizationEndpoint: provider.oidcConfig.authorizationEndpoint,
                        });
                        return ctx.json({
                            url: authorizationURL.toString(),
                            redirect: true,
                        });
                    }
both oidc and saml just return ctx.json instead of actually handling a redirect @bekacru any ideas as to why the sign-in isn't redirecting to the set callback url from the called function? it works flawlessly for microsoft social signin, but sso doesn't redirect the same way, even though its accurately assigning a session to the user and provisioning correctly. it just redirects to the saml2/callback/:providerId page with the json instead of the page set as the callback url

Did you find this page helpful?