fix(auth): address review on SSO registration, link start errors, and migration 0448

- Keep the SSO plugin's parsed registration body, as before 1.7.
- Compare issuers exactly when carrying over a token auth method.
- Surface linkSocial start errors in the connect hook and desktop launcher.
- Accept whitespace around WantAssertionsSigned in migration 0448 and the script.
- The register script refuses custom SP metadata that contradicts its signing
  flag and prints the stored SAML ACS URL.

Author: waleedlatif1

apps/sim/app/desktop/connect/connect-launcher.tsx

@@ -33,7 +33,7 @@ export function ConnectLauncher({ providerId, completeUrl }: ConnectLauncherProp
     setError(null)
     try {
       const scopes = getPerRequestOAuthLinkScopes(providerId)
-      await client.linkSocial({
+      const result = await client.linkSocial({
         provider: providerId,
         callbackURL: completeUrl,
         ...(scopes && { scopes }),
@@ -44,6 +44,9 @@ export function ConnectLauncher({ providerId, completeUrl }: ConnectLauncherProp
         // that the complete page can't read — so it would look like success.
         errorCallbackURL: completeUrl,
       })
+      if (result.error) {
+        setError(getErrorMessage(result.error.message, 'Could not start the connection.'))
+      }
     } catch (err) {
       setError(getErrorMessage(err, 'Could not start the connection.'))
     }

apps/sim/hooks/queries/oauth/connections.ts

@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { requestJson } from '@/lib/api/client/request'
 import {
@@ -205,11 +206,19 @@ export function useConnectOAuthService() {
       }
 
       const scopes = getPerRequestOAuthLinkScopes(providerId)
-      await client.linkSocial({
+      const result = await client.linkSocial({
         provider: providerId,
         callbackURL: stateCallbackUrl.toString(),
         ...(scopes && { scopes }),
       })
+      if (result.error) {
+        throw new Error(
+          getErrorMessage(
+            result.error.message,
+            result.error.statusText || 'Failed to start OAuth connection'
+          )
+        )
+      }
 
       return { success: true }
     },

apps/sim/lib/auth/sso/application/provider-registration.ts

@@ -329,9 +329,7 @@ export const saveSsoProvider = defineOrganizationConfigurationUseCase({
         clientSecret = secret
       }
       const existingTokenMethod =
-        existing && trimTrailingSlashes(existing.issuer) === trimTrailingSlashes(issuer)
-          ? stored.tokenEndpointAuthentication
-          : undefined
+        existing?.issuer === issuer ? stored.tokenEndpointAuthentication : undefined
 
       const oidcConfig: NonNullable<SsoProviderConfig['oidcConfig']> = {
         clientId,
@@ -679,7 +677,7 @@ export const saveSsoProvider = defineOrganizationConfigurationUseCase({
           providerConfig.oidcConfig.clientSecret = secret
         }
         if (
-          trimTrailingSlashes(existing.issuer) === trimTrailingSlashes(issuer) &&
+          existing.issuer === providerConfig.issuer &&
           (current.tokenEndpointAuthentication === 'client_secret_basic' ||
             current.tokenEndpointAuthentication === 'client_secret_post')
         )

apps/sim/lib/auth/sso/provider-repository.ts

@@ -202,8 +202,12 @@ export function createSsoProviderRepository(
   }
 
   return {
-    async register(body: SsoProviderConfig) {
-      plugin.endpoints.registerSSOProvider.options.body.parse(body)
+    async register(input: SsoProviderConfig) {
+      // Keep the parser's output so its defaults apply; its declared output type is untyped.
+      const body: SsoProviderConfig = {
+        ...input,
+        ...plugin.endpoints.registerSSOProvider.options.body.parse(input),
+      }
       if (body.organizationId !== organizationId)
         throw new APIError('BAD_REQUEST', {
           message: 'Provider organization does not match its authorized scope',

packages/db/migrations/0448_sso_saml_signin_authority.sql

@@ -49,7 +49,7 @@ BEGIN
     END IF;
 
     IF config->'wantAssertionsSigned' = 'true'::jsonb
-      AND coalesce(config #>> '{spMetadata,metadata}', '') !~ '\sWantAssertionsSigned=(["''])(true|1)\1' THEN
+      AND coalesce(config #>> '{spMetadata,metadata}', '') !~ '\sWantAssertionsSigned\s*=\s*(["''])(true|1)\1' THEN
       updated := jsonb_set(updated, '{wantAssertionsSigned}', 'false'::jsonb);
     END IF;
 

packages/db/scripts/register-sso-provider.ts

@@ -270,6 +270,15 @@ function buildSSOConfigFromEnv(): SSOProviderConfig | null {
     const wantAssertionsSigned = process.env.SSO_SAML_WANT_ASSERTIONS_SIGNED === 'true'
 
     let spMetadata = process.env.SSO_SAML_SP_METADATA
+    if (
+      spMetadata &&
+      wantAssertionsSigned &&
+      !/\sWantAssertionsSigned\s*=\s*(["'])(true|1)\1/.test(spMetadata)
+    ) {
+      throw new Error(
+        'SSO_SAML_SP_METADATA must declare WantAssertionsSigned="true" when SSO_SAML_WANT_ASSERTIONS_SIGNED=true'
+      )
+    }
     if (!spMetadata) {
       spMetadata = `<?xml version="1.0" encoding="UTF-8"?>
 <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${escapeXml(appBaseUrl)}">
@@ -726,13 +735,10 @@ async function registerSSOProvider(): Promise<boolean> {
 
     const baseUrl =
       process.env.NEXT_PUBLIC_APP_URL || process.env.BETTER_AUTH_URL || 'https://your-domain.com'
-    const callbackPath =
-      ssoConfig.providerType === 'saml'
-        ? `api/auth/sso/saml2/sp/acs/${ssoConfig.providerId}`
-        : `api/auth/sso/callback/${ssoConfig.providerId}`
-    logger.info(
-      `📋 Callback URL (configure this in your identity provider): ${baseUrl}/${callbackPath}`
-    )
+    const callbackUrl =
+      ssoConfig.samlConfig?.callbackUrl ??
+      `${baseUrl}/api/auth/sso/callback/${ssoConfig.providerId}`
+    logger.info(`📋 Callback URL (configure this in your identity provider): ${callbackUrl}`)
 
     return true
   } catch (error) {