The Architecture section still described identity as keyed on sub + iss, which stopped being universally true when 0005_user_oid.sql landed in #22.
Still correct for Authentik, Keycloak and Okta. On Entra, sub is pairwise — a different value per app registration for the same person — so oid is the key instead. Someone reading only the Architecture section would draw exactly the wrong conclusion about why a second account appeared, which is the failure mode #22 exists to prevent.
One paragraph, pointing at docs/oidc-entra-id.md §7 for the detail.
The Architecture section still described identity as keyed on `sub` + `iss`, which stopped being universally true when `0005_user_oid.sql` landed in #22.
Still correct for Authentik, Keycloak and Okta. On Entra, `sub` is **pairwise** — a different value per app registration for the same person — so `oid` is the key instead. Someone reading only the Architecture section would draw exactly the wrong conclusion about why a second account appeared, which is the failure mode #22 exists to prevent.
One paragraph, pointing at `docs/oidc-entra-id.md` §7 for the detail.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The Architecture section still described identity as keyed on `sub` + `iss`,
which stopped being universally true when 0005_user_oid.sql landed. It is
still correct for Authentik, Keycloak and Okta — but on Entra, `sub` is
pairwise per app registration and `oid` is the key. Someone reading only
this section would draw exactly the wrong conclusion about why a second
account appeared.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
jknapp
merged commit c68d72857f into main2026-08-13 02:40:44 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The Architecture section still described identity as keyed on
sub+iss, which stopped being universally true when0005_user_oid.sqllanded in #22.Still correct for Authentik, Keycloak and Okta. On Entra,
subis pairwise — a different value per app registration for the same person — sooidis the key instead. Someone reading only the Architecture section would draw exactly the wrong conclusion about why a second account appeared, which is the failure mode #22 exists to prevent.One paragraph, pointing at
docs/oidc-entra-id.md§7 for the detail.🤖 Generated with Claude Code