github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-19 11:24:57 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

docs(sso): lead the changeset with who is affected

Browse Source
This commit is contained in:
Gustavo Valverde
2026-10-14 20:53:14 +01:00
parent 4e32e0279f
commit f656a6c6e4
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/sso-email-less-profiles.md
+2 -2
View File
@@ -2,9 +2,9 @@
"@better-auth/sso": minor
---
SSO providers that send no email can now sign users in through the new `mapProfileToUser` option. It runs on every OIDC and SAML sign-in before the user is looked up, receives the provider's account key, profile, and raw claims or attributes, and can return the `email`, `name`, `image`, and `emailVerified` to use, such as a placeholder on the reserved `.invalid` domain. Previously these sign-ins failed with `missing_user_info`, and there was no way to supply an email.
SSO providers that send no email can now sign users in. The new `mapProfileToUser` option runs on every OIDC and SAML sign-in before the user is looked up, and can return the `email`, `name`, `image`, and `emailVerified` to use, such as a placeholder on the reserved `.invalid` domain. Previously these sign-ins failed with `missing_user_info`, and there was no way to supply an email. A returned email that differs from the provider's is stored unverified unless the callback also returns `emailVerified`, and a callback that throws redirects with `SSO_PROFILE_MAPPING_FAILED`.
**Breaking:** a SAML `NameID` now becomes the user's email only when its `Format` is `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`. Previously, a response without an email attribute used any NameID as the email, so an opaque persistent or transient NameID was stored as the user's email. Those sign-ins are now rejected, including for users created that way before. A SAML response without a usable email now redirects with `error=missing_user_info` instead of `error=saml_error`. Providers that send an email attribute, or an `emailAddress`-format NameID, are unaffected.
**Breaking for SAML providers that send no email attribute:** the `NameID` now becomes the user's email only when its `Format` is `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`. Previously any NameID was used, so an opaque persistent or transient NameID was stored as the user's email. Those sign-ins are now rejected, including for users created that way before the upgrade. A SAML response without a usable email redirects with `error=missing_user_info` instead of `error=saml_error`. Providers that send an email attribute, or an `emailAddress`-format NameID, are unaffected.
To keep the previous behavior for affected providers, return the NameID from `mapProfileToUser`: