From f656a6c6e4cda1cde480e21bf3feaae65fb89715 Mon Sep 17 00:00:00 2001 From: Gustavo Valverde Date: Wed, 14 Oct 2026 20:53:14 +0100 Subject: [PATCH] docs(sso): lead the changeset with who is affected --- .changeset/sso-email-less-profiles.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.changeset/sso-email-less-profiles.md b/.changeset/sso-email-less-profiles.md index 58e60243c2..e1898bd7ff 100644 --- a/.changeset/sso-email-less-profiles.md +++ b/.changeset/sso-email-less-profiles.md @@ -2,9 +2,9 @@ "@better-auth/sso": minor --- -SSO providers that send no email can now sign users in through the new `mapProfileToUser` option. It runs on every OIDC and SAML sign-in before the user is looked up, receives the provider's account key, profile, and raw claims or attributes, and can return the `email`, `name`, `image`, and `emailVerified` to use, such as a placeholder on the reserved `.invalid` domain. Previously these sign-ins failed with `missing_user_info`, and there was no way to supply an email. +SSO providers that send no email can now sign users in. The new `mapProfileToUser` option runs on every OIDC and SAML sign-in before the user is looked up, and can return the `email`, `name`, `image`, and `emailVerified` to use, such as a placeholder on the reserved `.invalid` domain. Previously these sign-ins failed with `missing_user_info`, and there was no way to supply an email. A returned email that differs from the provider's is stored unverified unless the callback also returns `emailVerified`, and a callback that throws redirects with `SSO_PROFILE_MAPPING_FAILED`. -**Breaking:** a SAML `NameID` now becomes the user's email only when its `Format` is `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`. Previously, a response without an email attribute used any NameID as the email, so an opaque persistent or transient NameID was stored as the user's email. Those sign-ins are now rejected, including for users created that way before. A SAML response without a usable email now redirects with `error=missing_user_info` instead of `error=saml_error`. Providers that send an email attribute, or an `emailAddress`-format NameID, are unaffected. +**Breaking for SAML providers that send no email attribute:** the `NameID` now becomes the user's email only when its `Format` is `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`. Previously any NameID was used, so an opaque persistent or transient NameID was stored as the user's email. Those sign-ins are now rejected, including for users created that way before the upgrade. A SAML response without a usable email redirects with `error=missing_user_info` instead of `error=saml_error`. Providers that send an email attribute, or an `emailAddress`-format NameID, are unaffected. To keep the previous behavior for affected providers, return the NameID from `mapProfileToUser`: