docs: note that Entra keys identity on oid, not sub #25

Merged

jknapp merged 1 commits from docs/identity-keying-note into main

2026-08-13 02:40:44 +00:00

Author	SHA1	Message	Date
shadowdaoandClaude Opus 5	391d8e0360	docs: note that Entra keys identity on oid, not sub The Architecture section still described identity as keyed on `sub` + `iss`, which stopped being universally true when 0005_user_oid.sql landed. It is still correct for Authentik, Keycloak and Okta — but on Entra, `sub` is pairwise per app registration and `oid` is the key. Someone reading only this section would draw exactly the wrong conclusion about why a second account appeared. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-12 19:40:31 -07:00

Author

SHA1

Message

Date

shadowdaoandClaude Opus 5

391d8e0360

docs: note that Entra keys identity on oid, not sub

The Architecture section still described identity as keyed on `sub` + `iss`,
which stopped being universally true when 0005_user_oid.sql landed. It is
still correct for Authentik, Keycloak and Okta — but on Entra, `sub` is
pairwise per app registration and `oid` is the key. Someone reading only
this section would draw exactly the wrong conclusion about why a second
account appeared.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-12 19:40:31 -07:00