github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-19 23:53:17 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

fix(microsoft)!: correct corporate and opaque claims

Browse Source
This commit is contained in:
Taesu
2026-10-16 09:59:01 +09:00
parent 25a23e0f76
commit 68b46d4bfa
3 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/microsoft-token-claims.md
+1 -1
View File
@@ -2,4 +2,4 @@
"@better-auth/core": minor
---
Microsoft profile callbacks now accept numeric token timestamps, claim arrays, and omitted conditional claims or profile photos. Profile mappings must handle these corrected values instead of treating timestamps as `Date` objects or all claims as present.
Microsoft profile callbacks now accept numeric token timestamps, claim arrays, boolean corporate-network flags, and omitted conditional or opaque claims and profile photos. Profile mappings must handle these corrected values instead of treating timestamps as `Date` objects or all claims as present.
packages/core/src/social-providers/microsoft-entra-id.test.ts
+3 -1
View File
@@ -345,6 +345,7 @@ describe("microsoft id_token alg omission", () => {
* @see https://github.com/better-auth/better-auth/issues/3802
* @see https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
* @see https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims-reference
* @see https://learn.microsoft.com/en-us/entra/identity-platform/access-token-claims-reference
*/
it("accepts numeric Microsoft timestamps and configured claim arrays", async () => {
const profile = {
@@ -353,7 +354,6 @@ it("accepts numeric Microsoft timestamps and configured claim arrays", async ()
iat: 1700000000,
nbf: 1700000000,
exp: 1700003600,
aio: "opaque-value",
oid: "ms-stable-oid",
sub: "ms-pairwise-sub",
tid: WORK_TENANT_ID,
@@ -361,6 +361,8 @@ it("accepts numeric Microsoft timestamps and configured claim arrays", async ()
assertType<MicrosoftEntraIDProfile>(profile);
const configuredProfile = {
...profile,
aio: "opaque-value",
in_corp: true,
auth_time: 1700000000,
groups: ["group-id"],
acrs: ["c1"],
packages/core/src/social-providers/microsoft-entra-id.ts
+2 -2
View File
@@ -45,7 +45,7 @@ export interface MicrosoftEntraIDProfile extends Record<string, any> {
/** Access token hash included in ID tokens when issued with an OAuth 2.0 access token */
at_hash?: string;
/** Internal claim used to record data for token reuse */
aio: string;
aio?: string;
/** The primary username that represents the user */
preferred_username?: string;
/** User's email address */
@@ -121,7 +121,7 @@ export interface MicrosoftEntraIDProfile extends Record<string, any> {
/** Change Password URL */
pwd_url?: string;
/** Inside Corporate Network flag */
in_corp?: string;
in_corp?: boolean;
/** User's family name/surname */
family_name?: string;
/** User's given/first name */