fix(sso): stop persisting generated IdP metadata so SAML cert rotation works

The route stored an IdP metadata document built from cert + entryPoint even when
the admin supplied none. The form loads that document back into its optional
metadata field and resends it, and on the next save it wins over the certificate
— so rotating a SAML signing certificate through the form appeared to succeed
and changed nothing.

Only metadata the admin actually pasted is persisted now. With none stored,
Better Auth's createIdP builds the IdP from issuer, entryPoint and cert, which
are the fields the form edits. No SAML providers exist in production, so this
changes no live tenant.

Author: waleedlatif1

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -356,6 +356,51 @@ describe('POST /api/auth/sso/register', () => {
     expect(sent.samlConfig).toHaveProperty('identifierFormat', '')
   })
 
+  /**
+   * Persisting generated IdP metadata made re-saving destructive: the form loaded
+   * it back, resent it, and it then won over the certificate — so rotating a SAML
+   * cert through the form silently did nothing.
+   */
+  it('does not persist generated IdP metadata when the admin supplied none', async () => {
+    queueMembers([{ organizationId: 'org1', role: 'owner' }])
+    queueProviders([])
+    await POST(
+      request({
+        providerType: 'saml',
+        providerId: 'acme-saml',
+        issuer: 'https://idp.acme.com',
+        domain: 'acme.com',
+        orgId: 'org1',
+        entryPoint: 'https://idp.acme.com/sso',
+        cert: 'ORIGINAL-CERT',
+      })
+    )
+    const sent = mockRegisterSSOProvider.mock.calls[0][0].body
+    expect(sent.samlConfig.idpMetadata).toBeUndefined()
+    expect(sent.samlConfig.cert).toBe('ORIGINAL-CERT')
+  })
+
+  it('persists IdP metadata the admin did supply', async () => {
+    queueMembers([{ organizationId: 'org1', role: 'owner' }])
+    queueProviders([])
+    await POST(
+      request({
+        providerType: 'saml',
+        providerId: 'acme-saml',
+        issuer: 'https://idp.acme.com',
+        domain: 'acme.com',
+        orgId: 'org1',
+        entryPoint: 'https://idp.acme.com/sso',
+        cert: 'CERT',
+        idpMetadata: '<EntityDescriptor>supplied</EntityDescriptor>',
+      })
+    )
+    const sent = mockRegisterSSOProvider.mock.calls[0][0].body
+    expect(sent.samlConfig.idpMetadata).toEqual({
+      metadata: '<EntityDescriptor>supplied</EntityDescriptor>',
+    })
+  })
+
   it('nests the attribute mapping inside oidcConfig (Better Auth reads it there)', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     await POST(

apps/sim/app/api/auth/sso/register/route.ts

@@ -514,40 +514,26 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   </md:SPSSODescriptor>
 </md:EntityDescriptor>`
 
-      const certBase64 = cert
-        .replace(/-----BEGIN CERTIFICATE-----/g, '')
-        .replace(/-----END CERTIFICATE-----/g, '')
-        .replace(/\s/g, '')
-
-      const computedIdpMetadataXml =
-        idpMetadata ||
-        `<?xml version="1.0"?>
-<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${escapeXml(issuer)}">
-  <IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-    <KeyDescriptor use="signing">
-      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-        <ds:X509Data>
-          <ds:X509Certificate>${certBase64}</ds:X509Certificate>
-        </ds:X509Data>
-      </ds:KeyInfo>
-    </KeyDescriptor>
-    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${escapeXml(entryPoint)}"/>
-    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="${escapeXml(entryPoint)}"/>
-  </IDPSSODescriptor>
-</EntityDescriptor>`
-
       const samlConfig: any = {
         entryPoint,
         cert,
         callbackUrl: computedCallbackUrl,
         spMetadata: {
           metadata: spMetadataXml,
         },
-        idpMetadata: {
-          metadata: computedIdpMetadataXml,
-        },
       }
 
+      /**
+       * Only persist IdP metadata the admin actually supplied. Storing a document
+       * generated from `cert` + `entryPoint` made re-saving destructive: the form
+       * loads it back into the optional metadata field, resends it, and it then
+       * wins over the certificate — so a cert rotation entered through the form
+       * silently did nothing. With no metadata stored, Better Auth's createIdP
+       * builds the IdP from issuer/entryPoint/cert, which are the fields the form
+       * actually edits.
+       */
+      if (idpMetadata) samlConfig.idpMetadata = { metadata: idpMetadata }
+
       if (audience) samlConfig.audience = audience
       if (wantAssertionsSigned !== undefined) samlConfig.wantAssertionsSigned = wantAssertionsSigned
       if (signatureAlgorithm) samlConfig.signatureAlgorithm = signatureAlgorithm