feat(sso): support encrypted SAML assertions and retire the registration scripts

Encrypted assertions are now configured in the settings UI and the registration API: the service provider certificate is published in the SP metadata Sim serves, and the matching private key is stored encrypted and handed to the SAML library for decryption. Request signing is deliberately absent — Better Auth's service provider neither signs requests nor publishes a signing certificate, so a key field for it would do nothing.

The operator registration scripts are removed along with the env vars and docs that drove them; the UI covers registration, and the scripts were a second write path with their own copy of the crypto. The field they wrote for assertion decryption was never read by the SAML library, so it never worked.

Also: run the new adapter PostgreSQL suite in CI, reject a stored OIDC config whose client secret is missing rather than saving a provider without one, and cover the nested service-provider keys in both encryption at rest and API redaction.

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -116,6 +116,7 @@ jobs:
           ee/scim/lib/managed-membership.postgres.test.ts
           lib/auth/sso/application/admit-sso-user.postgres.test.ts
           lib/auth/sso/primary-provider.postgres.test.ts
+          lib/auth/sso-provider-secret-adapter.postgres.test.ts
 
       - name: Verify billing and organization activity in PostgreSQL
         working-directory: apps/sim

apps/docs/content/docs/platform/enterprise/sso.mdx

@@ -103,7 +103,22 @@ Click **Save**. To test, sign out and use the **Sign in with SSO** button on the
 
 For a saved connection, open **Sign-in**, select the provider, and select **Edit**. The Provider ID remains fixed. **Delete** removes that sign-in path only: accounts and memberships it admitted stay. If you delete the primary provider and the domain has another verified provider, that one becomes primary; otherwise people at the domain sign in another way until a provider serves it again. A saved OIDC client secret appears as a mask with a suffix when available; **Replace** lets you enter a new secret, and **Keep saved** cancels that replacement. Provider secrets — the OIDC client secret, and SAML signing and decryption keys — are encrypted with `ENCRYPTION_KEY` before they are stored, so a copy of the database alone does not expose them. Select **Update** to save the provider, or **Discard** to abandon changes.
 
-**Advanced options** contains OIDC scopes and optional authorization, token, and JWKS endpoint overrides. For SAML, it contains Audience, Callback URL override, signed-assertion requirements, NameID format, and optional IdP metadata XML. **Attribute mapping** lets either protocol override the email, name, and stable user-ID claim names. Leave a mapping blank to use the protocol default.
+**Advanced options** contains OIDC scopes and optional authorization, token, and JWKS endpoint overrides. For SAML, it contains Audience, Callback URL override, signed-assertion requirements, encrypted assertions, NameID format, and optional IdP metadata XML. **Attribute mapping** lets either protocol override the email, name, and stable user-ID claim names. Leave a mapping blank to use the protocol default.
+
+### Encrypted assertions
+
+Turn on **Encrypt SAML assertions** when your identity provider encrypts the assertion, which some organizations require for assertions carrying personal data. It takes a key pair you generate:
+
+- **Service provider certificate** — the public half. Sim publishes it in its service provider metadata, and you upload it to the identity provider as the encryption certificate.
+- **Service provider private key** — the half Sim decrypts with. It is encrypted with `ENCRYPTION_KEY` before it is stored, and the form shows only a mask afterwards; **Replace** takes a new key.
+
+Generate a pair with `openssl req -x509 -newkey rsa:2048 -keyout sp-key.pem -out sp-cert.pem -days 3650 -nodes`. Turning the setting off clears the stored key.
+
+<Callout type="info">
+  Signing the authentication request Sim sends is not supported. Identity providers that
+  can require signed requests — Entra ID's **Require verification certificates**, for
+  example — must leave that off for Sim's application, which is their default.
+</Callout>
 
 SCIM settings save immediately in the **Provisioning** tab. Its **Disable just-in-time provisioning** rule overrides Automatic first-sign-in membership while the connection is active and entitled. Existing members can still sign in. See [directory provisioning](/platform/enterprise/scim#provisioning-and-sso-together).
 
@@ -417,48 +432,4 @@ SSO_TRUSTED_PROVIDER_IDS=custom-oidc,partner-saml
   depend on your IdP asserting `email_verified`.
 </Callout>
 
-You can register providers through the **Settings UI** (same as cloud) or by running the registration script directly against your database.
-
-### Script-based registration
-
-Use this when you need to register an SSO provider without going through the UI — for example, during initial deployment or CI/CD automation.
-
-```bash
-# OIDC example (Okta)
-SSO_ENABLED=true \
-NEXT_PUBLIC_APP_URL=https://your-instance.com \
-SSO_PROVIDER_TYPE=oidc \
-SSO_PROVIDER_ID=okta \
-SSO_ISSUER=https://dev-1234567.okta.com \
-SSO_DOMAIN=company.com \
-SSO_USER_EMAIL=admin@company.com \
-SSO_OIDC_CLIENT_ID=your-client-id \
-SSO_OIDC_CLIENT_SECRET=your-client-secret \
-bun run packages/db/scripts/register-sso-provider.ts
-```
-
-```bash
-# SAML example (ADFS)
-SSO_ENABLED=true \
-NEXT_PUBLIC_APP_URL=https://your-instance.com \
-SSO_PROVIDER_TYPE=saml \
-SSO_PROVIDER_ID=adfs \
-SSO_ISSUER=https://adfs.company.com/adfs/services/trust \
-SSO_SAML_AUDIENCE=https://your-instance.com \
-SSO_DOMAIN=company.com \
-SSO_USER_EMAIL=admin@company.com \
-SSO_SAML_ENTRY_POINT=https://adfs.company.com/adfs/ls \
-SSO_SAML_CERT="-----BEGIN CERTIFICATE-----
-...
------END CERTIFICATE-----" \
-bun run packages/db/scripts/register-sso-provider.ts
-```
-
-The script outputs the callback URL to configure in your IdP once it completes.
-
-To remove a provider:
-
-```bash
-SSO_USER_EMAIL=admin@company.com \
-bun run packages/db/scripts/deregister-sso-provider.ts
-```
+Register providers through the **Settings UI**, the same flow as cloud. Verify the email domain first: a provider is only saved against a domain the organization has verified, which is what authorizes it to sign people in.

apps/sim/app/api/auth/sso/providers/route.ts

@@ -11,7 +11,11 @@ import { listSsoProvidersContract } from '@/lib/api/contracts/auth'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { markSignInProviders } from '@/lib/auth/sso/primary-provider'
-import { decryptProviderConfig } from '@/lib/auth/sso-provider-secrets'
+import {
+  decryptProviderConfig,
+  resolveHolder,
+  SECRET_FIELDS,
+} from '@/lib/auth/sso-provider-secrets'
 import { REDACTED_MARKER } from '@/lib/core/security/redaction'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
@@ -58,17 +62,23 @@ async function redactOidcConfig(oidcConfig: string | null): Promise<string | nul
 }
 
 /**
- * Drops the SAML key material an admin never needs back. Unlike the OIDC secret
- * these carry no hint: they are the service provider's own signing and
- * decryption keys, they are only ever set by the operator registration script,
- * and the settings form does not read them.
+ * Drops the SAML key material an admin never needs back: the service provider's
+ * own signing and decryption keys. Unlike the OIDC secret these carry no hint —
+ * the admin holds the key pair already, and the certificate half stays readable.
+ * The same field list drives encryption at rest, so the two cannot drift.
  */
 function redactSamlConfig(samlConfig: string | null): string | null {
   if (!samlConfig) return samlConfig
   try {
     const parsed = JSON.parse(samlConfig)
-    for (const field of ['privateKey', 'decryptionPvk']) {
-      if (typeof parsed[field] === 'string' && parsed[field] !== '') parsed[field] = REDACTED_MARKER
+    if (!parsed || typeof parsed !== 'object') return null
+    for (const path of SECRET_FIELDS.samlConfig) {
+      const holder = resolveHolder(parsed, path)
+      if (!holder) continue
+      const field = path[path.length - 1]
+      if (typeof holder[field] === 'string' && holder[field] !== '') {
+        holder[field] = REDACTED_MARKER
+      }
     }
     return JSON.stringify(parsed)
   } catch {

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -345,6 +345,155 @@ describe('POST /api/auth/sso/register', () => {
     expect(mockDecryptSecret).not.toHaveBeenCalled()
   })
 
+  it.each([
+    ['no client secret', JSON.stringify({ clientId: 'client' })],
+    ['an empty client secret', JSON.stringify({ clientId: 'client', clientSecret: '' })],
+  ])('refuses to reuse a stored config with %s', async (_label, oidcConfig) => {
+    queueMembers([{ organizationId: 'org1', role: 'owner' }])
+    queueTableRows(schemaMock.ssoProvider, [])
+    queueTableRows(schemaMock.ssoProvider, [])
+    queueTableRows(schemaMock.ssoProvider, [{ oidcConfig }])
+
+    const res = await POST(request({ ...OIDC_BODY, clientSecret: '[REDACTED]' }))
+
+    expect(res.status).toBe(400)
+    await expect(res.json()).resolves.toMatchObject({
+      error: expect.stringContaining('Re-enter your client secret'),
+    })
+    expect(mockUpdateSSOProvider).not.toHaveBeenCalled()
+  })
+
+  describe('SAML encrypted assertions', () => {
+    const SP_CERT = `-----BEGIN CERTIFICATE-----\nQUJD\n-----END CERTIFICATE-----`
+    const SP_KEY = `-----BEGIN PRIVATE KEY-----\nREVG\n-----END PRIVATE KEY-----`
+    const samlBody = (overrides: Record<string, unknown> = {}) => ({
+      providerType: 'saml' as const,
+      providerId: 'acme-saml',
+      issuer: 'https://idp.acme.com',
+      domain: 'acme.com',
+      orgId: 'org1',
+      entryPoint: 'https://idp.acme.com/sso',
+      cert: 'IDP-CERT',
+      ...overrides,
+    })
+
+    it('publishes the certificate and keeps the private key for decryption', async () => {
+      queueMembers([{ organizationId: 'org1', role: 'owner' }])
+      queueProviders([])
+
+      const res = await POST(
+        request(
+          samlBody({ encryptAssertions: true, spEncryptionCert: SP_CERT, spDecryptionKey: SP_KEY })
+        )
+      )
+
+      expect(res.status).toBe(200)
+      const { samlConfig } = mockRegisterSSOProvider.mock.calls[0][0].body
+      expect(samlConfig.spMetadata).toMatchObject({
+        isAssertionEncrypted: true,
+        encPrivateKey: SP_KEY,
+        encryptionCert: SP_CERT,
+      })
+      /** The certificate travels in the metadata document, stripped of its PEM armor. */
+      expect(samlConfig.spMetadata.metadata).toContain('use="encryption"')
+      expect(samlConfig.spMetadata.metadata).toContain('QUJD')
+      expect(samlConfig.spMetadata.metadata).not.toContain('BEGIN CERTIFICATE')
+      expect(samlConfig.spMetadata.metadata).not.toContain('REVG')
+    })
+
+    it('leaves the metadata and key material alone when encryption is off', async () => {
+      queueMembers([{ organizationId: 'org1', role: 'owner' }])
+      queueProviders([])
+
+      const res = await POST(request(samlBody()))
+
+      expect(res.status).toBe(200)
+      const { samlConfig } = mockRegisterSSOProvider.mock.calls[0][0].body
+      expect(samlConfig.spMetadata).not.toHaveProperty('encPrivateKey')
+      expect(samlConfig.spMetadata).not.toHaveProperty('isAssertionEncrypted')
+      expect(samlConfig.spMetadata).not.toHaveProperty('encryptionCert')
+      expect(samlConfig.spMetadata.metadata).not.toContain('use="encryption"')
+    })
+
+    it.each([
+      ['no certificate', { spDecryptionKey: SP_KEY }],
+      ['no private key', { spEncryptionCert: SP_CERT }],
+    ])('refuses to enable encryption with %s', async (_label, overrides) => {
+      queueMembers([{ organizationId: 'org1', role: 'owner' }])
+      queueProviders([])
+
+      const res = await POST(request(samlBody({ encryptAssertions: true, ...overrides })))
+
+      expect(res.status).toBe(400)
+      expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
+    })
+
+    it.each([
+      [
+        'a certificate that is not PEM',
+        { spEncryptionCert: 'not-a-cert', spDecryptionKey: SP_KEY },
+      ],
+      ['a private key that is not PEM', { spEncryptionCert: SP_CERT, spDecryptionKey: 'nope' }],
+    ])('refuses %s', async (_label, overrides) => {
+      queueMembers([{ organizationId: 'org1', role: 'owner' }])
+      queueProviders([])
+
+      const res = await POST(request(samlBody({ encryptAssertions: true, ...overrides })))
+
+      expect(res.status).toBe(400)
+      await expect(res.json()).resolves.toMatchObject({ error: expect.stringContaining('PEM') })
+      expect(mockRegisterSSOProvider).not.toHaveBeenCalled()
+    })
+
+    it('keeps the stored private key when the update sends the marker', async () => {
+      queueMembers([{ organizationId: 'org1', role: 'owner' }])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [
+        { samlConfig: JSON.stringify({ spMetadata: { encPrivateKey: SP_KEY } }) },
+      ])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [{ id: 'p1' }])
+
+      const res = await POST(
+        request(
+          samlBody({
+            encryptAssertions: true,
+            spEncryptionCert: SP_CERT,
+            spDecryptionKey: '[REDACTED]',
+          })
+        )
+      )
+
+      expect(res.status).toBe(200)
+      const { samlConfig } = mockUpdateSSOProvider.mock.calls[0][0].body
+      expect(samlConfig.spMetadata.encPrivateKey).toBe(SP_KEY)
+    })
+
+    it('refuses the marker when no key is stored', async () => {
+      queueMembers([{ organizationId: 'org1', role: 'owner' }])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [])
+      queueTableRows(schemaMock.ssoProvider, [{ samlConfig: JSON.stringify({ spMetadata: {} }) }])
+
+      const res = await POST(
+        request(
+          samlBody({
+            encryptAssertions: true,
+            spEncryptionCert: SP_CERT,
+            spDecryptionKey: '[REDACTED]',
+          })
+        )
+      )
+
+      expect(res.status).toBe(400)
+      await expect(res.json()).resolves.toMatchObject({
+        error: expect.stringContaining('no stored service provider private key'),
+      })
+    })
+  })
+
   /** updateSSOProvider resets domainVerified to false whenever the domain changes. */
   it('re-marks the provider domain-verified after an update', async () => {
     queueMembers([{ organizationId: 'org1', role: 'owner' }])