[hf]

Some SAML identity providers (famously Entra) don't allow the same entity ID to be registered with multiple "applications," making Supabase Auth usable only with one application. Some enterprise use-cases are therefore hard to build.

In this PR we add a dedicated_scope optional boolean on an SSO provider, which in SAML means that the provider can only be used via its own new Entity ID and URLs scoped to the provider's unique ID.

Dedicated scope	Entity ID, Metadata URL	ACS URL
False or Null	/sso/saml/metadata	/sso//saml/acs
True	/sso/{uuid}/saml/metadata	/sso/{uuid}/saml/acs

This way in Entra you can register many SPs served by the same Supabase Auth project by creating them with the dedicated_scope boolean.

Notes:

• Adds a dedicated_scope boolean to SAML SSO providers. When set, that provider's ACS URL and SP metadata URL (and, by extension, the entity ID GoTrue presents to the IdP, which defaults to the metadata URL) are scoped to the provider's own ID, instead of using the URLs shared by every SAML provider in the project. The same signing key/certificate is still used.
• Useful for IdPs that require a unique ACS URL/entity ID per connection, and isolates assertions issued for one connection from being replayed against another.
• New dedicated routes GET /sso/{sso_provider_id}/saml/metadata and POST /sso/{sso_provider_id}/saml/acs alongside the existing shared /sso/saml/* endpoints; the ACS handler rejects a provider hitting the wrong endpoint for its scope setting.
• dedicated_scope can be set on create/update via the admin SSO provider API and is documented in openapi.yaml.

[hf]

Addressed the security review findings on the dedicated_scope ACS/entity-ID scoping (fixed in 46c0560):

• Scope-confusion bypass in IdP-initiated flow: the dedicated-scope guard now runs after ParseResponse succeeds (i.e. after cryptographic validation), instead of before it based on the unauthenticated Issuer peeked from the raw SAMLResponse XML. Also added a check that an IdP-initiated request hitting a dedicated-scope endpoint must carry an explicit Destination matching that endpoint's ACS URL, rather than relying on the library's conditional check.
• No protection against toggling dedicated_scope on a live provider: the admin update handler now logs a WARN (with old/new value and provider ID) whenever dedicated_scope changes on an existing provider, since this immediately changes the ACS URL/entity ID that provider expects.
• The informational note about the pre-validation XML peek of the untrusted SAMLResponse is pre-existing behavior (used to look up which provider's key to validate against) and unchanged by this PR.