fix: preserve idpinitiated.enabled:false on SAML connection export instead of emitting undefined_clientId

src/tools/auth0/handlers/connections.ts

@@ -448,12 +448,15 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
 
   getFormattedOptions(connection, clients) {
     try {
+      const { idpinitiated } = connection.options;
       return {
         options: {
           ...connection.options,
           idpinitiated: {
-            ...connection.options.idpinitiated,
-            client_id: convertClientNameToId(connection.options.idpinitiated.client_id, clients),
+            ...idpinitiated,
+            ...(idpinitiated.client_id && {
+              client_id: convertClientNameToId(idpinitiated.client_id, clients),
+            }),
           },
         },
       };

src/utils.ts

@@ -334,12 +334,15 @@ export const decodeBase64ToCertString = (base64Cert: string) => {
 // Format connection options by converting client IDs to client names for SAML connections
 export const getFormattedOptions = (connection, clients) => {
   try {
+    const { idpinitiated } = connection.options;
     return {
       options: {
         ...connection.options,
         idpinitiated: {
-          ...connection.options.idpinitiated,
-          client_id: convertClientIdToName(connection.options.idpinitiated.client_id, clients),
+          ...idpinitiated,
+          ...(idpinitiated.client_id && {
+            client_id: convertClientIdToName(idpinitiated.client_id, clients),
+          }),
         },
       },
     };

test/context/directory/connections.test.js

@@ -154,6 +154,31 @@ describe('#directory context connections', () => {
     );
   });
 
+  it('should dump samlp connection with idpinitiated login disabled', async () => {
+    const dir = path.join(testDataDir, 'directory', 'connectionsDump');
+    cleanThenMkdir(dir);
+    const context = new Context({ AUTH0_INPUT_FILE: dir }, mockMgmtClient());
+
+    context.assets.connections = [
+      {
+        name: 'someSamlConnectionIdpInitiatedDisabled',
+        strategy: 'samlp',
+        enabled_clients: [],
+        options: {
+          passwordPolicy: 'testPolicy',
+          idpinitiated: { enabled: false },
+        },
+      },
+    ];
+
+    await handler.dump(context);
+    const connectionsFolder = path.join(dir, constants.CONNECTIONS_DIRECTORY);
+    expect(
+      loadJSON(path.join(connectionsFolder, 'someSamlConnectionIdpInitiatedDisabled.json')).options
+        .idpinitiated
+    ).to.deep.equal({ enabled: false });
+  });
+
   it('should dump connections sanitized', async () => {
     const dir = path.join(testDataDir, 'directory', 'connectionsDump');
     cleanThenMkdir(dir);

test/context/yaml/connections.test.js

@@ -189,6 +189,17 @@ describe('#YAML context connections', () => {
           },
         },
       },
+      {
+        name: 'someSamlConnectionIdpInitiatedDisabled',
+        strategy: 'samlp',
+        enabled_clients: [],
+        options: {
+          passwordPolicy: 'testPolicy',
+          idpinitiated: {
+            enabled: false,
+          },
+        },
+      },
     ];
 
     const target = [
@@ -238,6 +249,17 @@ describe('#YAML context connections', () => {
           },
         },
       },
+      {
+        name: 'someSamlConnectionIdpInitiatedDisabled',
+        strategy: 'samlp',
+        enabled_clients: [],
+        options: {
+          passwordPolicy: 'testPolicy',
+          idpinitiated: {
+            enabled: false,
+          },
+        },
+      },
     ];
 
     const clients = [

test/tools/auth0/handlers/connections.tests.js

@@ -1476,6 +1476,22 @@ describe('#connections handler', () => {
       await stageFn.apply(handler, [{ connections: data }]);
     });
 
+    it('should not add a client_id to idpinitiated when login is disabled', () => {
+      const handler = new connections.default({ client: pageClient({ pool }), config });
+      const connection = {
+        options: {
+          passwordPolicy: 'testPolicy',
+          idpinitiated: { enabled: false },
+        },
+      };
+
+      const formatted = handler.getFormattedOptions(connection, [
+        { name: 'client1', client_id: 'client1-id' },
+      ]);
+
+      expect(formatted.options.idpinitiated).to.deep.equal({ enabled: false });
+    });
+
     // If client is excluded and in the existing connection this client is enabled, it should keep enabled
     // If client is excluded and in the existing connection this client is disabled, it should keep disabled
     it('should handle excluded clients properly', async () => {