Bug: Microsoft Entra ID (OIDC) creates a new user when one has already been created by another connector

[tevass]

Describe the bug

The Microsoft Entra ID (OIDC) SSO Connector creates a new user when one has already been created by another connector.

Expected behavior

Link the already registered user when it exists

How to reproduce?

Start Logto, configure Microsoft Entra ID (OIDC) with the Trust unverified email option either enabled or disabled, and another connector, in my case, Google Workspace. Sign in the first time with the other connector, and the second time, sign in with Microsoft Entra ID (OIDC) using the same email for both connectors. Then, check in User Management how many users were created.

Context

• Self-hosted, Logto version = v1.24.0
  • Container (Docker image)
  • Raw Node.js

Additional information

Trying to understand what happened, I discovered that when AzureOidcSsoConnector calls getUserInfo, the getIdTokenClaims and getUserInfo functions from OidcConnector/utils didn’t return the email field. However, in the ID token payload, there was a field called preferred_username containing my user's email.

[wangsijie]

Hi, can you please share the detail user info returned from Microsoft Entra ID? You can find it in "Audit Logs", check the log to make sure you can get email from the provider.

[tevass]

I took a screenshot of my user properties.

In "Audit Logs," I selected an entry, and it contains my email under "User Principal Name" (UPN).

I also took a screenshot of the "Sign-in Logs", where my email appears under "Username."

I ran Logto locally to show the decoded token claims and user info in console.log.

// Decoded Token Claims
{
  email: '[email protected]',
  name: 'Estevão Biondi',
  preferred_username: '[email protected]'
}

// User Info
{
  sub: '...'
  name: 'Estevão Biondi',
  picture: 'https://graph.microsoft.com/v1.0/me/photo/$value'
}