[twk3]

Merge when chart 1.0 is published, not before. Pages deploys main's docs on merge, and until 1.0 is out the latest published chart is 0.8.1, which answers the new ACS URL with 404.

Updates the SAML SSO setup for Better Auth 1.7.1 and adds an upgrade guide for chart 1.0 (ENG-1736, ENG-1735).

SAML SSO

What changed in the API:

• The ACS URL moved from /api/auth/sso/saml2/callback/<providerId> to /api/auth/sso/saml2/sp/acs/<providerId>. The old path answers 404.
• IdP-initiated sign-ins are refused unless SSO_SAML_ALLOW_IDP_INITIATED is true. Better Auth accepted them up to 1.6.
• 1.7.1 checks the assertion's Recipient and Destination against the ACS URL.
• The Audience is still currents.sso.saml.issuer. Better Auth uses it as the SP entity ID.

Changes:

• currents.sso.saml.allowIdpInitiated (default false) renders SSO_SAML_ALLOW_IDP_INITIATED=true on the server. The chart builds the environment explicitly, so the setting needs a value.
• docs/eks/quickstart.md, SSO section:
  • the new ACS URL, with Recipient and Destination set to it;
  • allowIdpInitiated;
  • the SP metadata URL, /api/auth/sso/saml2/sp/metadata?providerId=<providerId>.
• providerId's description gives the full ACS URL, and configuration.md is regenerated.

Upgrade guide for 1.0

docs/eks/upgrade-1.0.md covers going from 0.8.x to 1.0.0. It's linked from upgrading.md, the docs index and the quickstart. It starts with a table of each change and what the operator has to do, then covers:

• SAML SSO: the IdP steps for the ACS move, which can only happen once the upgrade is done, and allowIdpInitiated.
• App content bucket:
  • create it, add its CORS and lifecycle rules, and add it to the IRSA policy;
  • set appContentStorage.bucket;
  • for an in-cluster RustFS, move to 1.0.1 and run the bucket Job again.
• Remote MCP and OAuth: on by default after the upgrade, how to keep them off, and curl checks.
• Database migrations:
  • what runs, and the timings from the ENG-1741 rehearsal;
  • the change-streams load that follows;
  • the scheduler reports ready before the migrations finish;
  • the expected Kept the existing index warnings, and what to do on an error.
• Removed values: spCertKey.
• Artifact expiry.
• Rollback: the migrations stay applied, so take a backup first.

Not in the guide:

• What 1.0 means for the chart (stable values, support boundary, bundled dependencies). That's ENG-1742's decision.
• The 1.0 image tag, which isn't cut yet. The guide refers to the chart's default.

Testing

• helm template with SSO on: SSO_SAML_ALLOW_IDP_INITIATED renders only with allowIdpInitiated: true.
• helm lint with the CI values passes, and configuration.md matches helm-docs.
• The SSO behavior was read from the API and from @better-auth/sso 1.7.1. It wasn't exercised against a real IdP.

Related

• Docker Compose: docs: move the SAML ACS URL to /sp/acs and document IdP-initiated sign-in [ENG-1736] docker#33
• The 0.8.x docs: docs: publish the 0.8 docs under 0.8/docs, pinned to chart 0.8.1 [ENG-1736] #62. It keeps them published at /helm-charts/0.8/docs/, linked from the docs index and this guide. Merge it first: once this PR merges, the published docs give 0.8.1 operators an ACS URL their install answers with 404.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UhM4wHR2xPP8bbrkXGaqUD

[baz-reviewer]

Baz Summary

Update Helm-based SAML SSO configuration for Better Auth 1.7.1 by documenting the new ACS and metadata endpoints, enforcing Recipient/Destination guidance, and adding opt-in IdP-initiated sign-ins through allowIdpInitiated. Add a Chart 1.0 upgrade guide covering SAML migration, storage, integrations, migrations, removed values, and rollback requirements.

Topics

Topic	Details
Chart 1.0 Upgrade	Provide operators with a linked Chart 1.0 upgrade path covering required SAML and bucket changes, default integrations, database migration behavior, removed values, artifact expiry, and rollback considerations. Modified files (4) docs/README.md docs/eks/quickstart.md docs/eks/upgrade-1.0.md docs/eks/upgrading.md Latest Contributors(2) User Commit Date dj@currents.dev fix: keep a quoted "fa... October 14, 2026 agoldis@users.noreply.... Update README.md June 04, 2025
SAML SSO Migration	Document the Better Auth 1.7.1 SAML endpoint changes, clarify the stable Audience value, and expose allowIdpInitiated as an opt-in environment setting for IdP-started sign-ins. Modified files (5) charts/currents/templates/_common.tpl charts/currents/values.yaml docs/configuration.md docs/eks/quickstart.md docs/eks/upgrade-1.0.md Latest Contributors(2) User Commit Date dj@currents.dev fix: keep a quoted "fa... October 14, 2026 agoldis@users.noreply.... Refine naming April 10, 2025

  _{Activate to get a short verdict whether this PR is good to go or not}

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}