fix(sso): encrypt SSO provider secrets at rest

The OIDC client secret, and the SAML signing and decryption keys, were stored as plain JSON in sso_provider while every sibling credential is encrypted with ENCRYPTION_KEY, so a copy of the database exposed them without the key. They are now encrypted field-by-field at the Better Auth adapter, which is the only seam the SSO plugin's reads and writes both pass through; the surrounding config stays readable JSON. Values written before this keep working and are encrypted the next time the provider is saved. The providers API also redacts the SAML key material it used to return in full.

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/sso.mdx

@@ -101,7 +101,7 @@ Click **Save**. To test, sign out and use the **Sign in with SSO** button on the
 
 ## Editing and advanced configuration
 
-For a saved connection, open **Sign-in**, select the provider, and select **Edit**. The Provider ID remains fixed. **Delete** removes that sign-in path only: accounts and memberships it admitted stay. If you delete the primary provider and the domain has another verified provider, that one becomes primary; otherwise people at the domain sign in another way until a provider serves it again. A saved OIDC client secret appears as a mask with a suffix when available; **Replace** lets you enter a new secret, and **Keep saved** cancels that replacement. Select **Update** to save the provider, or **Discard** to abandon changes.
+For a saved connection, open **Sign-in**, select the provider, and select **Edit**. The Provider ID remains fixed. **Delete** removes that sign-in path only: accounts and memberships it admitted stay. If you delete the primary provider and the domain has another verified provider, that one becomes primary; otherwise people at the domain sign in another way until a provider serves it again. A saved OIDC client secret appears as a mask with a suffix when available; **Replace** lets you enter a new secret, and **Keep saved** cancels that replacement. Provider secrets — the OIDC client secret, and SAML signing and decryption keys — are encrypted with `ENCRYPTION_KEY` before they are stored, so a copy of the database alone does not expose them. Select **Update** to save the provider, or **Discard** to abandon changes.
 
 **Advanced options** contains OIDC scopes and optional authorization, token, and JWKS endpoint overrides. For SAML, it contains Audience, Callback URL override, signed-assertion requirements, NameID format, and optional IdP metadata XML. **Attribute mapping** lets either protocol override the email, name, and stable user-ID claim names. Leave a mapping blank to use the protocol default.
 

apps/docs/content/docs/platform/self-hosting/architecture.mdx

@@ -73,7 +73,7 @@ Three places once the deployment is configured for production. Everything else i
 </Callout>
 
 <Callout type="error">
-  `ENCRYPTION_KEY` is not recoverable and not derivable. It encrypts workspace and personal environment variables, stored provider API keys, MCP OAuth credentials, and deployment/chat secrets at rest — a database restore paired with a *different* key yields a working app in which none of that can be decrypted. Back it up separately from the database, and never rotate it casually.
+  `ENCRYPTION_KEY` is not recoverable and not derivable. It encrypts workspace and personal environment variables, stored provider API keys, MCP OAuth credentials, deployment/chat secrets, and SSO provider secrets at rest — a database restore paired with a *different* key yields a working app in which none of that can be decrypted. Back it up separately from the database, and never rotate it casually.
 </Callout>
 
 Redis is a cache and message bus. Losing it drops in-flight live updates; it does not lose committed data.

apps/docs/content/docs/platform/self-hosting/docker.mdx

@@ -48,7 +48,7 @@ EOF
 </Callout>
 
 <Callout type="error">
-  Save `ENCRYPTION_KEY` and `API_ENCRYPTION_KEY` somewhere outside this server. `ENCRYPTION_KEY` encrypts workspace and personal environment variables, stored provider API keys, MCP OAuth credentials, and deployment/chat secrets; `API_ENCRYPTION_KEY` encrypts user-generated Sim API keys. Neither can be regenerated — a database restore paired with a different key leaves the data it protected permanently unreadable.
+  Save `ENCRYPTION_KEY` and `API_ENCRYPTION_KEY` somewhere outside this server. `ENCRYPTION_KEY` encrypts workspace and personal environment variables, stored provider API keys, MCP OAuth credentials, deployment/chat secrets, and SSO provider secrets; `API_ENCRYPTION_KEY` encrypts user-generated Sim API keys. Neither can be regenerated — a database restore paired with a different key leaves the data it protected permanently unreadable.
 </Callout>
 
 The compose file refuses to start if `BETTER_AUTH_SECRET`, `ENCRYPTION_KEY`, `INTERNAL_API_SECRET`, or `POSTGRES_PASSWORD` is missing, rather than booting with empty or well-known values. Postgres applies `POSTGRES_PASSWORD` only when it first creates the database volume — see [Postgres on Compose](/platform/self-hosting/security#postgres-on-compose) before changing it on an existing install. `CRON_SECRET` is treated more gently: without it the `cron` service prints what to set and exits, leaving the rest of the stack running — so upgrading from a compose file that predates the scheduler still works.

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -19,7 +19,7 @@ import { Callout } from 'fumadocs-ui/components/callout'
 `openssl rand -hex 32` prints 64 hex characters. `ENCRYPTION_KEY` and `API_ENCRYPTION_KEY` must be exactly that — a value of any other shape throws the first time Sim encrypts or decrypts, not at startup. The rest are secrets of no fixed shape and only need 32 characters or more. The Sim app never checks — it runs its env schema with validation skipped — but the realtime service validates `BETTER_AUTH_SECRET` and `INTERNAL_API_SECRET` at boot and refuses to start if either is shorter.
 
 <Callout type="error">
-  `ENCRYPTION_KEY` and `API_ENCRYPTION_KEY` cannot be rotated or recovered. Losing either makes the data it protects permanently unreadable — workspace and personal environment variables, stored provider API keys, MCP OAuth credentials, and deployment/chat secrets in the first case, user-generated Sim API keys in the second. Back them up separately from the database.
+  `ENCRYPTION_KEY` and `API_ENCRYPTION_KEY` cannot be rotated or recovered. Losing either makes the data it protects permanently unreadable — workspace and personal environment variables, stored provider API keys, MCP OAuth credentials, deployment/chat secrets, and SSO provider secrets in the first case, user-generated Sim API keys in the second. Back them up separately from the database.
 </Callout>
 
 ## Strongly recommended

apps/docs/content/docs/platform/self-hosting/kubernetes.mdx

@@ -51,7 +51,7 @@ helm install sim oci://ghcr.io/simstudioai/charts/sim \
 ```
 
 <Callout type="warn">
-  Save all six values somewhere durable before moving on. `ENCRYPTION_KEY` in particular cannot be regenerated — losing it makes workspace environment variables and stored provider keys permanently unreadable.
+  Save all six values somewhere durable before moving on. `ENCRYPTION_KEY` in particular cannot be regenerated — losing it makes workspace environment variables, stored provider keys, and SSO provider secrets permanently unreadable.
 
   `API_ENCRYPTION_KEY` is optional, and the failure mode is silent: leave it unset and Sim stores user-generated API keys **in plain text**, logging one warning and nothing else. Set it at install time — it must be a 64-character hex string, which is exactly what `openssl rand -hex 32` produces — and back it up like `ENCRYPTION_KEY`.
 
@@ -102,7 +102,7 @@ Signing is Sigstore-only — there is no GPG `.prov` file, so `helm install --ve
 
 ## Cloud-Specific Values
 
-These are cloud-tuned **alternatives** to the generic install above — pick one path, don't run both. The commands reuse the `$BETTER_AUTH_SECRET`, `$ENCRYPTION_KEY`, `$INTERNAL_API_SECRET`, `$API_ENCRYPTION_KEY`, `$CRON_SECRET`, and `$POSTGRES_PASSWORD` variables generated in [Installation](#installation) above, so run that block's `openssl` lines first in the same shell. They use `helm upgrade --install`, so they work whether or not a release exists yet. Two caveats when converting an existing generic install rather than starting fresh: (1) **reuse the original secret values** — recover them with `helm get values sim -n simstudio` if your shell no longer has them; supplying a newly generated `ENCRYPTION_KEY` makes every previously encrypted value (workspace environment variables, stored provider keys, MCP OAuth credentials) undecryptable. (2) The cloud values rename the bundled PostgreSQL database to `simstudio`, but Postgres only applies that setting on first initialization — add `--set postgresql.auth.database=sim` to keep your existing database. If you'd rather start clean, `helm uninstall sim -n simstudio`, delete its PVCs, and run the cloud command fresh.
+These are cloud-tuned **alternatives** to the generic install above — pick one path, don't run both. The commands reuse the `$BETTER_AUTH_SECRET`, `$ENCRYPTION_KEY`, `$INTERNAL_API_SECRET`, `$API_ENCRYPTION_KEY`, `$CRON_SECRET`, and `$POSTGRES_PASSWORD` variables generated in [Installation](#installation) above, so run that block's `openssl` lines first in the same shell. They use `helm upgrade --install`, so they work whether or not a release exists yet. Two caveats when converting an existing generic install rather than starting fresh: (1) **reuse the original secret values** — recover them with `helm get values sim -n simstudio` if your shell no longer has them; supplying a newly generated `ENCRYPTION_KEY` makes every previously encrypted value (workspace environment variables, stored provider keys, MCP OAuth credentials, SSO provider secrets) undecryptable. (2) The cloud values rename the bundled PostgreSQL database to `simstudio`, but Postgres only applies that setting on first initialization — add `--set postgresql.auth.database=sim` to keep your existing database. If you'd rather start clean, `helm uninstall sim -n simstudio`, delete its PVCs, and run the cloud command fresh.
 
 ```bash
 # The example values files are not part of the packaged chart, so fetch the one

apps/docs/content/docs/platform/self-hosting/security.mdx

@@ -13,7 +13,7 @@ Five secrets drive the security of a deployment. Generate each with `openssl ran
 | Secret | Protects | Rotatable |
 |---|---|---|
 | `BETTER_AUTH_SECRET` | Session tokens | Yes — invalidates all sessions |
-| `ENCRYPTION_KEY` | Workspace env vars, stored provider keys, MCP OAuth credentials, deployment/chat secrets | **No** — see below |
+| `ENCRYPTION_KEY` | Workspace env vars, stored provider keys, MCP OAuth credentials, deployment/chat secrets, SSO provider secrets | **No** — see below |
 | `API_ENCRYPTION_KEY` | Reversible stored copy of user-generated API keys | **No** — existing keys keep authenticating, but their stored copy can no longer be displayed |
 | `INTERNAL_API_SECRET` | Service-to-service calls | Yes — roll app and realtime together |
 | `CRON_SECRET` | Background job endpoints | Yes — roll app and cron together |

apps/docs/content/docs/platform/self-hosting/troubleshooting.mdx

@@ -258,6 +258,8 @@ A document that fails with `vector 0 has N unexpected dimensions` means `EMBEDDI
 
 Integrations show as connected but fail, or provider keys error on decrypt. `ENCRYPTION_KEY` does not match the value in use when the backup was taken. There is no recovery — the original key must be restored.
 
+SSO sign-in fails the same way, since provider secrets are encrypted with the same key. A provider whose secret cannot be decrypted refuses the sign-in rather than sending an unusable secret to the identity provider; re-enter the client secret in organization settings once the correct key is in place.
+
 ## Kubernetes: App Pods Never Become Ready
 
 Check the migrations init container first — a failed migration deliberately blocks the rollout:

apps/docs/content/docs/platform/self-hosting/upgrades.mdx

@@ -233,7 +233,7 @@ There is a short window where the app is unavailable while containers restart. C
 
 ### Verify
 
-Run the [verification checklist](/platform/self-hosting/verify). At minimum: sign in, open a workflow, execute it, upload a file, and confirm the [background jobs](/platform/self-hosting/background-jobs) are still firing.
+Run the [verification checklist](/platform/self-hosting/verify). At minimum: sign in, open a workflow, execute it, upload a file, and confirm the [background jobs](/platform/self-hosting/background-jobs) are still firing. If the deployment uses [SSO](/platform/enterprise/sso), complete one SSO sign-in too — provider secrets are encrypted with `ENCRYPTION_KEY`, so a key that does not match the one they were saved under surfaces here.
 
 </Step>
 

apps/sim/app/api/auth/sso/providers/route.test.ts

@@ -11,19 +11,33 @@ import {
 } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockGetSession } = vi.hoisted(() => ({ mockGetSession: vi.fn() }))
+const { mockGetSession, mockDecryptSecret } = vi.hoisted(() => ({
+  mockGetSession: vi.fn(),
+  mockDecryptSecret: vi.fn(),
+}))
 
 vi.mock('@sim/db', () => ({ ...dbChainMock, ...schemaMock }))
 vi.mock('@/lib/auth', () => ({ getSession: mockGetSession }))
+/** The shared env mock's ENCRYPTION_KEY is not 64 hex characters, so real crypto would throw. */
+vi.mock('@/lib/core/security/encryption', () => ({
+  encryptSecret: vi.fn(),
+  decryptSecret: mockDecryptSecret,
+}))
 
 import { GET } from '@/app/api/auth/sso/providers/route'
 
+const IV = 'a'.repeat(32)
+const TAG = 'b'.repeat(32)
+const sealed = (secret: string) => `${IV}:${Buffer.from(secret).toString('hex')}:${TAG}`
+
+const CLIENT_SECRET = 'a-long-client-secret-wxyz'
+
 const providerRow = {
   id: 'row-1',
   providerId: 'acme-okta',
   domain: 'acme.com',
   issuer: 'https://acme.okta.test',
-  oidcConfig: JSON.stringify({ clientId: 'client', clientSecret: 'a-long-client-secret-wxyz' }),
+  oidcConfig: JSON.stringify({ clientId: 'client', clientSecret: sealed(CLIENT_SECRET) }),
   samlConfig: null,
   userId: 'user-1',
   organizationId: 'org-1',
@@ -38,6 +52,9 @@ describe('GET /api/auth/sso/providers', () => {
     vi.clearAllMocks()
     resetDbChainMock()
     mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockDecryptSecret.mockImplementation(async (value: string) => ({
+      decrypted: Buffer.from(value.split(':')[1], 'hex').toString('utf8'),
+    }))
   })
 
   it('refuses a caller without a session before reading any provider', async () => {
@@ -56,10 +73,55 @@ describe('GET /api/auth/sso/providers', () => {
     expect(providers[0]).toMatchObject({ providerId: 'acme-okta', providerType: 'oidc' })
     expect(JSON.parse(providers[0].oidcConfig)).toMatchObject({ clientSecretHint: 'wxyz' })
     expect(providers[0].oidcConfig).not.toContain('a-long-client-secret')
+    expect(providers[0].oidcConfig).not.toContain(sealed(CLIENT_SECRET))
     const condition = JSON.stringify(dbChainMockFns.where.mock.calls[0][0])
     expect(condition).toContain('user-1')
   })
 
+  it('hints a secret stored before encryption existed', async () => {
+    queueTableRows(schemaMock.ssoProvider, [
+      {
+        ...providerRow,
+        oidcConfig: JSON.stringify({ clientId: 'client', clientSecret: CLIENT_SECRET }),
+      },
+    ])
+
+    const res = await GET(createMockRequest('GET'))
+
+    const { providers } = await res.json()
+    expect(JSON.parse(providers[0].oidcConfig)).toMatchObject({ clientSecretHint: 'wxyz' })
+    expect(providers[0].oidcConfig).not.toContain(CLIENT_SECRET)
+    expect(mockDecryptSecret).not.toHaveBeenCalled()
+  })
+
+  it('redacts SAML key material and keeps the certificate', async () => {
+    queueTableRows(schemaMock.ssoProvider, [
+      {
+        ...providerRow,
+        oidcConfig: null,
+        samlConfig: JSON.stringify({
+          cert: 'public-cert',
+          entryPoint: 'https://acme.okta.test/sso',
+          privateKey: sealed('sp-signing-key'),
+          decryptionPvk: sealed('sp-decryption-key'),
+        }),
+      },
+    ])
+
+    const res = await GET(createMockRequest('GET'))
+
+    const { providers } = await res.json()
+    const samlConfig = JSON.parse(providers[0].samlConfig)
+    expect(samlConfig).toMatchObject({
+      cert: 'public-cert',
+      entryPoint: 'https://acme.okta.test/sso',
+      privateKey: '[REDACTED]',
+      decryptionPvk: '[REDACTED]',
+    })
+    expect(providers[0].samlConfig).not.toContain('sp-signing-key')
+    expect(providers[0].providerType).toBe('saml')
+  })
+
   it('refuses an organization the caller does not administer', async () => {
     queueTableRows(schemaMock.member, [{ organizationId: 'org-1', role: 'member' }])
     const res = await GET(

apps/sim/app/api/auth/sso/providers/route.ts

@@ -11,6 +11,7 @@ import { listSsoProvidersContract } from '@/lib/api/contracts/auth'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { markSignInProviders } from '@/lib/auth/sso/primary-provider'
+import { decryptProviderConfig } from '@/lib/auth/sso/provider-secrets'
 import { REDACTED_MARKER } from '@/lib/core/security/redaction'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
@@ -31,6 +32,44 @@ function buildClientSecretHint(clientSecret: unknown): string | null {
   return clientSecret.slice(-4)
 }
 
+/**
+ * Replaces the stored client secret with the redaction marker, keeping a hint
+ * built from the real secret. The stored value is decrypted first: a hint taken
+ * from the envelope would be four characters of the auth tag, which says nothing
+ * about the secret and changes every time the row is rewritten.
+ */
+async function redactOidcConfig(oidcConfig: string | null): Promise<string | null> {
+  if (!oidcConfig) return oidcConfig
+  try {
+    const parsed = JSON.parse((await decryptProviderConfig(oidcConfig, 'oidcConfig')) as string)
+    const hint = buildClientSecretHint(parsed.clientSecret)
+    parsed.clientSecret = REDACTED_MARKER
+    if (hint) parsed.clientSecretHint = hint
+    return JSON.stringify(parsed)
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Drops the SAML key material an admin never needs back. Unlike the OIDC secret
+ * these carry no hint: they are the service provider's own signing and
+ * decryption keys, they are only ever set by the operator registration script,
+ * and the settings form does not read them.
+ */
+function redactSamlConfig(samlConfig: string | null): string | null {
+  if (!samlConfig) return samlConfig
+  try {
+    const parsed = JSON.parse(samlConfig)
+    for (const field of ['privateKey', 'decryptionPvk']) {
+      if (typeof parsed[field] === 'string' && parsed[field] !== '') parsed[field] = REDACTED_MARKER
+    }
+    return JSON.stringify(parsed)
+  } catch {
+    return null
+  }
+}
+
 /**
  * Lists the identity providers the caller administers: an organization's when an
  * owner or admin names it, otherwise the ones the caller registered.
@@ -90,25 +129,14 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       .where(whereClause)
       .orderBy(asc(ssoProvider.providerId))
 
-    const providers = markSignInProviders(results).map((provider) => {
-      let oidcConfig = provider.oidcConfig
-      if (oidcConfig) {
-        try {
-          const parsed = JSON.parse(oidcConfig)
-          const hint = buildClientSecretHint(parsed.clientSecret)
-          parsed.clientSecret = REDACTED_MARKER
-          if (hint) parsed.clientSecretHint = hint
-          oidcConfig = JSON.stringify(parsed)
-        } catch {
-          oidcConfig = null
-        }
-      }
-      return {
+    const providers = await Promise.all(
+      markSignInProviders(results).map(async (provider) => ({
         ...provider,
-        oidcConfig,
+        oidcConfig: await redactOidcConfig(provider.oidcConfig),
+        samlConfig: redactSamlConfig(provider.samlConfig),
         providerType: (provider.samlConfig ? 'saml' : 'oidc') as 'oidc' | 'saml',
-      }
-    })
+      }))
+    )
 
     logger.info('Fetched SSO providers', { userId, providerCount: providers.length })