fix(auth): let Microsoft sign-in link via Entra's domain-verified email claim by waleedlatif1 · Pull Request #6546 · simstudioai/sim

waleedlatif1 · 2026-08-11T18:10:21Z

Summary

microsoft is excluded from accountLinking.trustedProviders because the email claim is attacker-controllable on /common/ (nOAuth). Entra never emits email_verified for work/school accounts, so Better Auth refused to link a Microsoft identity onto any existing user row — those users hit account_not_linked permanently, with no recovery path
Derive emailVerified from Entra's xms_edov optional claim, emitted only when the email's domain belongs to the user's tenant and an admin verified that domain. It's the one email signal a hostile tenant cannot forge, and it's Microsoft's documented nOAuth mitigation. microsoft stays untrusted — the linking guard now passes on its own merits
The mapper returns {} when unverified, so it only ever promotes unverified → verified, never downgrades. With the claim absent, Better Auth's computation is byte-identical to today
Add prompt=select_account, so /common/ stops silently reusing whichever Microsoft session the browser already holds
Add /oauth-error copy for account_not_linked and email_not_found, which currently dead-end on "Please try again" — advice that can never succeed

Requires an Entra change to take effect

Inert until xms_edov and email are added as optional claims on the ID token for the app registration (xms_edov requires email to be present). Until then the mapper returns {} and behavior is unchanged.

Known limitation: xms_edov is false for SAML/WS-Fed federated domains and for B2B guests, so those tenants remain unlinkable and should use Entra SSO, which is trusted for linking.

Verified against the Better Auth source

callback.mjs:140-152 passes getUserInfo's result into handleOAuthUserInfo; microsoft-entra-id.mjs:91-107 builds it from decodeJwt(idToken), so xms_edov is visible to mapProfileToUser, whose result is spread last (:116)
overrideUserInfoOnSignIn is unset, so the branch that rewrites email/emailVerified on every sign-in (link-account.mjs:67-77) never runs
Existing Microsoft users get emailVerified upgraded on next sign-in (link-account.mjs:49,65), guarded on exact email match — an upgrade, never a downgrade
Welcome email fires exactly once: today Microsoft users get none (auth.ts:348 gates on emailVerified); after this they get one at creation. afterEmailVerification only runs in the verification flow, which OAuth signups don't enter — no duplicate
The OAuth verification-email branch (link-account.mjs:105) needs both sendOnSignUp and sendVerificationEmail; we set neither, so it stays dead
Integration connectors are untouched — they're genericOAuth entries with their own providerId and getUserInfo

Type of Change

Bug fix

Testing

bun run type-check clean; 297 tests across 18 files in lib/auth + lib/oauth pass; verified the new tests fail when the mapper is stubbed out.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…il claim Microsoft is excluded from accountLinking.trustedProviders because the email claim is attacker-controllable on /common/ (nOAuth). Entra never emits email_verified for work/school accounts, so Better Auth refused to link a Microsoft identity onto any existing user row, permanently stranding those users on account_not_linked. Derive emailVerified from the xms_edov optional claim, which Entra emits only when the email's domain belongs to the user's tenant and an admin verified it — the one email signal a hostile tenant cannot forge. Microsoft stays untrusted; the guard now passes on its own merits. The mapper returns an empty object when unverified, so it can only ever promote unverified to verified, never downgrade.

vercel · 2026-08-11T18:10:27Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 11, 2026 6:32pm

cursor · 2026-08-11T18:10:33Z

PR Summary

High Risk
Touches authentication, account linking, and email-verification promotion for Microsoft OAuth; incorrect trust in xms_edov could affect who can link to an existing account (mitigated by only promoting verified, not downgrading).

Overview
Fixes Microsoft sign-in for users who already have a Sim account by deriving emailVerified from Entra’s xms_edov optional claim (domain-owned, admin-verified email) via mapMicrosoftProfileToUser, so account linking can succeed without adding microsoft to trustedProviders. The mapper only promotes unverified → verified (returns {} otherwise); behavior is unchanged until xms_edov and email are configured on the app registration.

Microsoft social login now uses prompt: 'select_account' so /common/ does not silently reuse an existing browser session.

The /oauth-error page adds actionable copy for account_not_linked and email_not_found instead of a generic “try again.”

^{Reviewed by Cursor Bugbot for commit 5675934. Configure here.}

greptile-apps · 2026-08-11T18:14:27Z

Greptile Summary

The PR updates Microsoft authentication to recognize Entra’s domain-verified email claim while keeping Microsoft excluded from trusted account-linking providers.

Maps a verified xms_edov claim to emailVerified: true without downgrading absent or unverified claims.
Requests explicit Microsoft account selection during sign-in.
Adds actionable messages for account-linking and missing-email OAuth failures.
Adds focused tests for accepted and rejected xms_edov encodings.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains in the eligible follow-up review scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/oauth/microsoft.ts	Adds a narrowly scoped mapper that promotes Microsoft email verification only for accepted `xms_edov` values.
apps/sim/lib/auth/auth.ts	Wires the mapper and explicit account-selection prompt into the Microsoft social provider configuration.
apps/sim/lib/oauth/microsoft.test.ts	Tests verified, unverified, absent, string, and numeric encodings of the Entra claim.
apps/sim/app/oauth-error/page.tsx	Adds recovery-oriented messages for account-linking and missing-email failures.

Sequence Diagram

sequenceDiagram
  participant User
  participant Sim as Sim Auth
  participant Entra as Microsoft Entra
  participant BA as Better Auth
  User->>Sim: Sign in with Microsoft
  Sim->>Entra: "Authorize with prompt=select_account"
  Entra-->>BA: ID token with email and optional xms_edov
  BA->>Sim: Map Microsoft profile
  alt xms_edov is verified
    Sim-->>BA: "emailVerified=true"
    BA->>BA: Evaluate existing-account linking
  else claim absent or unverified
    Sim-->>BA: No profile override
    BA->>BA: Preserve existing verification result
  end

_{Reviews (3): Last reviewed commit: "chore(auth): tighten the Microsoft linki..." | Re-trigger Greptile}

Hosted Sim serves many Entra tenants, so it must stay on the multi-tenant endpoint — pinning is only meaningful for a self-hoster restricting sign-in to their own directory, and nobody is asking for that yet. The xms_edov fix is independent of the tenant setting, so this removes surface without touching behavior.

waleedlatif1 · 2026-08-11T18:28:20Z

@greptile

waleedlatif1 · 2026-08-11T18:28:21Z

@cursor review

waleedlatif1 · 2026-08-11T18:32:22Z

@greptile

waleedlatif1 · 2026-08-11T18:32:30Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5675934. Configure here.}

vercel Bot temporarily deployed to Preview August 11, 2026 18:27 Inactive

chore(auth): tighten the Microsoft linking comments

5675934

vercel Bot temporarily deployed to Preview August 11, 2026 18:32 Inactive

cursor Bot reviewed Aug 11, 2026

View reviewed changes

waleedlatif1 merged commit bf82512 into staging Aug 11, 2026
29 checks passed

waleedlatif1 deleted the fix/microsoft-oauth-linking branch August 11, 2026 18:41

This was referenced Aug 11, 2026

v0.8.0: new workflow UI, v2 API, salesforce JWT, provenance improvements, incidentio tools, block retries #6533

Closed

v0.8.0: desktop app, workflow UI, v2 endpoints #6606

Merged

Navigation Menu

Uh oh!

fix(auth): let Microsoft sign-in link via Entra's domain-verified email claim - #6546

fix(auth): let Microsoft sign-in link via Entra's domain-verified email claim#6546
waleedlatif1 merged 3 commits into
stagingfrom
fix/microsoft-oauth-linking

waleedlatif1 commented Aug 11, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Aug 11, 2026 •

edited

Loading

Important Files Changed

Sequence Diagram

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

waleedlatif1 commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Requires an Entra change to take effect

Verified against the Better Auth source

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

waleedlatif1 commented Aug 11, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Aug 11, 2026 •

edited

Loading

vercel Bot commented Aug 11, 2026 •

edited

Loading

cursor Bot commented Aug 11, 2026 •

edited

Loading

greptile-apps Bot commented Aug 11, 2026 •

edited

Loading