OIDC enterprise login
Enterprise customers need to authenticate through an OIDC identity provider such as Okta.
Better Auth · Const
sso
The Better Auth SSO plugin adds OIDC and SAML single sign-on support. Enable it with sso(), then register identity providers with their required configuration.
How it works
The SSO plugin adds enterprise sign-on support to Better Auth. Configure it in the auth instance, then register OIDC or SAML providers; OIDC registration validates the provider's discovery document and generates a redirect URL from the provider ID.
Syntax
sso()Returns
A Better Auth configuration with the SSO plugin enabled.
Key points
- Install the dedicated @better-auth/sso package before configuring the plugin.
- OIDC providers are added through the registerSSOProvider endpoint.
- The provider ID is used to generate the SSO redirect URL.
- SAML setup requires Service Provider metadata configuration.
- SAML registration creates metadata and callback endpoints automatically.
Common mistakes
- Provider IDs share a namespace with social providers and trusted account-linking providers, so collisions are rejected.
- OIDC registration depends on a valid identity-provider discovery document.
Example: Enable SSO
import { betterAuth } from "better-auth";
import { sso } from "@better-auth/sso";
export const auth = betterAuth({
plugins: [sso()],
});Install @better-auth/sso, then add the plugin to the Better Auth configuration.
When to use it
SAML federation
An organization requires SAML-based federation with an identity provider.
IdP-initiated SSO
Users should launch the application from their identity provider dashboard.
Interview questions
QHow do you enable the SSO plugin?
Add sso() from @better-auth/sso to the plugins array in betterAuth. The plugin then exposes SSO functionality for provider registration and authentication.
Follow-up: How are OIDC providers registered? Use the registerSSOProvider endpoint with the provider configuration, including a unique provider ID.
QWhat happens when an OIDC provider is registered?
Register an OIDC provider through the registerSSOProvider endpoint with its required configuration. Better Auth validates the provider's OIDC discovery document and creates a redirect URL using the provider ID.
Follow-up: What must be checked before choosing a provider ID? Ensure it does not conflict with social providers, trusted account-linking providers, or reserved built-in IDs.
QWhat does SAML configuration require?
SAML registration requires Service Provider metadata configuration. The SSO plugin creates SAML metadata and callback endpoints for the registered provider.
Follow-up: What kind of SSO flow can SAML support besides application-initiated login? IdP-initiated login is supported, with the identity provider posting the SAML response to the callback endpoint.
Related
registerSSOProviderOIDC providerSAML providerSAML callbackSP metadata