Adds support to manage Native to SSO configuration on clients

[kailash-b]

✏️ Changes

This change adds support for managing Native to SSO (Single Sign-On) configuration on Auth0 clients through the Management API.

Classes and methods added:

• New SessionTransfer model class with properties for configuring native-to-web SSO behavior
• Added SessionTransfer property to ClientBase class

Properties added to SessionTransfer model:

• CanCreateSessionTransferToken - Controls whether an app can issue session tokens through Token Exchange
• AllowedAuthenticationMethods - Specifies which methods can create sessions from session tokens
• EnforceDeviceBinding - Configures device binding security (by IP, ASN, or none)
• AllowRefreshToken - Controls refresh token issuance during session transfer authentication
• EnforceOnlineRefreshTokens - Ties refresh tokens to session lifetime
• EnforceCascadeRevocation - Enables cascade revocation of dependent tokens

Usage summary:
This feature allows developers to configure Native to Web SSO settings when creating or updating Auth0 clients. The SessionTransfer property can be set on client creation/update requests to control how native applications can transfer authentication sessions to web applications.

🔗 References

• SDK-6872
• Native to Web SSO Support #882

🎯 Testing

This change has been tested through integration tests that verify:

• Creating clients with session transfer configuration
• Updating existing clients with session transfer settings
• Reading back session transfer configuration from created/updated clients
• All session transfer properties are properly serialized/deserialized

Testing coverage:

• Integration tests added in ClientTests.cs covering full CRUD operations with session transfer configuration

• Tests verify all boolean, string, and array properties are handled correctly

• Tests cover both enabled and disabled states for all configuration options

• This change adds unit test coverage

• This change adds integration test coverage

• This change has been tested on the latest version of the platform/language

✅ Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete

[kailash-b]

@claude

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.20%. Comparing base (81dfecf) to head (7f05091).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #885      +/-   ##
==========================================
+ Coverage   79.18%   79.20%   +0.02%     
==========================================
  Files         456      457       +1     
  Lines        5908     5915       +7     
  Branches      277      277              
==========================================
+ Hits         4678     4685       +7     
  Misses       1136     1136              
  Partials       94       94              

Flag	Coverage Δ
authIntTests	30.60% <0.00%> (-0.04%)	⬇️
mgmtIntTests	60.79% <100.00%> (+0.04%)	⬆️
unittests	8.96% <0.00%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Claude finished @kailash-b's task —— View job

---

Code Review Complete ✅

• Read PR diff and understand changes
• Read project copilot instructions (none found)
• Start pending review
• Analyze code for issues and provide feedback
• Submit review with overall assessment

Review Summary: Found issues with type safety and documentation that should be addressed. The implementation is functionally correct but could benefit from using enums for string properties to follow existing patterns and improve validation.

---

[github-actions]

Overall Assessment

❌ There are several issues that should be addressed for better type safety and code quality.

The implementation correctly adds Native to SSO configuration support with proper JSON serialization and comprehensive integration tests. However, the code could benefit from stronger typing using enums instead of string literals for validation and consistency with existing patterns in the codebase.

Key concerns:

• String properties lack validation and type safety
• XML documentation formatting issues
• Missing enums for constrained string values

The integration tests are thorough and cover all scenarios appropriately.

[kailash-b]

@claude

[github-actions]

Claude finished @kailash-b's task —— View job

---

Code Review Complete ✅

• Read PR diff and understand changes
• Read project copilot instructions (none found)
• Start pending review
• Analyze code for issues and provide feedback
• Submit review with overall assessment

Review Summary: The implementation is functional and well-tested but has minor type safety concerns. The AllowedAuthenticationMethods property should use an enum for type safety rather than a string array to follow existing patterns and prevent invalid values.

---

[github-actions]

Overall Assessment

✅ The implementation is functional and well-tested, but has minor type safety concerns.

The PR successfully adds Native to SSO configuration support with comprehensive integration tests and proper JSON serialization. The enum approach for DeviceBindingType is correctly implemented. However, the AllowedAuthenticationMethods property lacks type safety and validation, which could lead to runtime issues with invalid values.

Key recommendations:

• Create an enum for authentication methods to match the pattern used for DeviceBindingType
• This will improve maintainability and prevent invalid values from being set

The integration tests are thorough and cover all scenarios appropriately.

[mfolker-sage]

Can I suggest using an enum for AllowedAuthenticationMethods, i.e.

[JsonProperty("allowed_authentication_methods", ItemConverterType = typeof(StringEnumConverter))]
public SessionTransferAuthenticationMethod[]? AllowedAuthenticationMethods { get; set; }

///

/// Allowed authentication methods for session transfer.
///

public enum SessionTransferAuthenticationMethod
{
[EnumMember(Value = "cookie")]
Cookie,
[EnumMember(Value = "query")]
Query
}

[mfolker-sage]

Also, I would appreciate being notified when this is merged and pushed to the public nuget server if possible.

[kailash-b]

Hi @mfolker-sage 👋

Can I suggest using an enum for AllowedAuthenticationMethods, i.e.

[JsonProperty("allowed_authentication_methods", ItemConverterType = typeof(StringEnumConverter))]
public SessionTransferAuthenticationMethod[]? AllowedAuthenticationMethods { get; set; }

///

/// Allowed authentication methods for session transfer.
///

public enum SessionTransferAuthenticationMethod
{
[EnumMember(Value = "cookie")]
Cookie,
[EnumMember(Value = "query")]
Query
}

This would have ideally been the approach if the allowed values were clearly mentioned on the auth0/docs. Since we do not know what the allowed values are, we let it be as is. If in the future these values are mentioned in the docs, then we will also update the SDK accordingly.

Also, I would appreciate being notified when this is merged and pushed to the public nuget server if possible.

Sure! We will keep the original issue updated as soon as this fix is released and is available for use.

[mfolker-sage]

This would have ideally been the approach if the allowed values were clearly mentioned on the auth0/docs. Since we do not know what the allowed values are, we let it be as is. If in the future these values are mentioned in the docs, then we will also update the SDK accordingly.

https://auth0.com/docs/authenticate/single-sign-on/native-to-web/configure-implement-native-to-web

If it helps, I think it is pretty clear in the documentation above.

[kailash-b]

This would have ideally been the approach if the allowed values were clearly mentioned on the auth0/docs. Since we do not know what the allowed values are, we let it be as is. If in the future these values are mentioned in the docs, then we will also update the SDK accordingly.

https://auth0.com/docs/authenticate/single-sign-on/native-to-web/configure-implement-native-to-web

If it helps, I think it is pretty clear in the documentation above.

That is correct. However, the SDK implementation is bound to the API's schema. Since the schema does not restrict the users from sending any string, we will not be able to add that constraint in the SDK for now.

In the meantime, we will initiate an internal discussion on whether this can be made explicit in the schema as well. That will make it clear for everyone. Once that reaches a conclusion, we will update the type to an enum