From 391d8e03606f2983f7165e6c7b92197cd7c8487f Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Wed, 12 Aug 2026 19:40:31 -0700 Subject: [PATCH] docs: note that Entra keys identity on oid, not sub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Architecture section still described identity as keyed on `sub` + `iss`, which stopped being universally true when 0005_user_oid.sql landed. It is still correct for Authentik, Keycloak and Okta — but on Entra, `sub` is pairwise per app registration and `oid` is the key. Someone reading only this section would draw exactly the wrong conclusion about why a second account appeared. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6eb19c2..027c51d 100644 --- a/README.md +++ b/README.md @@ -37,8 +37,10 @@ Workspace. Anything that publishes a `/.well-known/openid-configuration`. The same container serves both the MCP endpoint (under `/api/mcp`) and the Web UI. Users authenticate via your OIDC provider with pre-registered -confidential clients. Identity is keyed on the OIDC `sub` + `iss` so -memories are scoped per user. +confidential clients. Identity is keyed on the OIDC `iss` + `sub` so memories +are scoped per user — except on Microsoft Entra ID, where `sub` is pairwise +(a different value per app registration for the same person) and `oid` is +used instead. See [`docs/oidc-entra-id.md`](docs/oidc-entra-id.md) §7. ---