[harshithRai]

🔧 Changes

Enables the Cross App Access requesting app options on samlp connections, following the Management API change that makes them available on SAML the same way they already are on oidc and okta.

token_endpoint_auth_signing_alg and token_endpoint_jwtca_aud_format were rejected by validate() for every strategy except oidc and okta, so a samlp connection carrying them could not be deployed. They are now accepted on samlp too. id_token_signed_response_algs and id_token_session_expiry_supported stay oidc and okta only. The validation error now names the strategies allowed for the offending options and reports every violated group at once. The top-level cross_app_access_requesting_app and the other options (client_id, client_secret, discovery_url, oidc_metadata, token_endpoint_auth_method) already passed through, so they needed no handler change.

The second change closes a data-loss path that this feature makes relevant. Export masks options.client_secret as ##CONNECTIONS_<STRATEGY>_SECRET##. When that placeholder is left unresolved on import it is stripped before the update, and because Auth0 replaces options as a whole on update, the stored secret was cleared with no warning. The connections handler now substitutes the stored secret when the placeholder is unresolved and a connection with the same name already has one, in both the real import and the dry run. An explicit empty client_secret still clears it. This applies to every strategy, not only samlp.

Not a breaking change: validation is only loosened, and the secret handling only changes the previously destructive case. Tenant feature flags still gate some values on the API side (active: true, private_key_jwt, discovery_url and oidc_metadata), and the API returns its own error when they are off. The docs now describe this for samlp.

Shape

A samlp connection could previously carry the requesting app and client credential fields, but not the signing algorithm or audience format.

YAML, before (the two token endpoint fields below failed validation on samlp):

connections:
  - name: saml-xaa
    strategy: samlp
    cross_app_access_requesting_app:
      active: true
    options:
      # ...
      client_id: idp-client-id
      client_secret: "##CONNECTIONS_SAMLP_SECRET##"
      token_endpoint_auth_method: private_key_jwt

YAML, after:

connections:
  - name: saml-xaa
    strategy: samlp
    cross_app_access_requesting_app:
      active: true
    options:
      # ...
      client_id: idp-client-id
      client_secret: "##CONNECTIONS_SAMLP_SECRET##"
      token_endpoint_auth_method: private_key_jwt
      token_endpoint_auth_signing_alg: RS256
      token_endpoint_jwtca_aud_format: issuer

Directory (JSON), before:

{
  "name": "saml-xaa",
  "strategy": "samlp",
  "cross_app_access_requesting_app": { "active": true },
  "options": {
    "client_id": "idp-client-id",
    "client_secret": "##CONNECTIONS_SAMLP_SECRET##",
    "token_endpoint_auth_method": "private_key_jwt"
  }
}

Directory (JSON), after:

{
  "name": "saml-xaa",
  "strategy": "samlp",
  "cross_app_access_requesting_app": { "active": true },
  "options": {
    "client_id": "idp-client-id",
    "client_secret": "##CONNECTIONS_SAMLP_SECRET##",
    "token_endpoint_auth_method": "private_key_jwt",
    "token_endpoint_auth_signing_alg": "RS256",
    "token_endpoint_jwtca_aud_format": "issuer"
  }
}

🔬 Testing

Unit tests

Added or updated in test/tools/auth0/handlers/connections.tests.js:

• Allows token_endpoint_auth_signing_alg and token_endpoint_jwtca_aud_format on samlp alongside the other requesting app options (replaces the test that asserted samlp was rejected)
• Rejects id_token_signed_response_algs and id_token_session_expiry_supported on samlp, without flagging the token endpoint fields
• Rejects the token endpoint options on other strategies, and the error lists oidc, okta and samlp
• Reports unsupported options from both restricted groups in one error
• Reuses the stored client_secret when the exported placeholder is unresolved, in both calcChanges and dryRunChanges
• Leaves the placeholder alone when no secret is stored
• Does not override an explicit client_secret or an explicit empty one
• restoreMaskedClientSecret ignores connections without options and connections with no stored match

Manual verification

Against a live tenant with token_vault_xaa and token_vault_xaa_saml enabled, scoped to connections:

1. Add a samlp connection with cross_app_access_requesting_app.active: true, client_id, client_secret, a discovery_url, private_key_jwt, RS256 and issuer, in both YAML and directory format. The dry run previews a single create.
2. Import it and read the connection back through the Management API. Every field is present and oidc_metadata is populated from the discovery URL.
3. Export, and confirm client_secret is written as ##CONNECTIONS_SAMLP_SECRET##. Import that export without a keyword mapping and confirm the stored secret is unchanged. With a mapping, confirm the new value is applied. Setting client_secret to "" clears it.
4. Set active: false and confirm the role turns off. Omit cross_app_access_requesting_app and confirm it stays unchanged.
5. On a tenant without the flags, confirm active: true and private_key_jwt return 400 operation_not_supported, and that client_id, client_secret, client_secret_post, the signing algorithm and the audience format are accepted.

Not covered: discovery_url with the flags off (the API returned a discovery fetch error before it reached the flag check), and the secret handling on oidc and okta connections beyond the unit tests.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.66%. Comparing base (5770977) to head (64ca28b).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1535      +/-   ##
==========================================
+ Coverage   82.64%   82.66%   +0.01%     
==========================================
  Files         193      193              
  Lines        9301     9310       +9     
  Branches     2061     2064       +3     
==========================================
+ Hits         7687     7696       +9     
  Misses        816      816              
  Partials      798      798              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.