Repository navigation
feat(users): trusted single-tenant UPN policy for Microsoft sign-in (#873) - #912
Merged
Merged
Conversation
…873) oauth_microsoft_trust_tenant_upn (off by default) treats a member account's userPrincipalName as a verified email when oauth_microsoft_tenant is a GUID, so invited and verified local accounts link on first Microsoft sign-in. Guest (#EXT#) UPNs and empty identities stay unverified; a non-GUID tenant logs users.oauth.microsoft_trust_ignored and keeps the old behaviour. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4
Exclude Microsoft's consumers tenant GUID and non-canonical GUID spellings from the trust policy; document that the policy trusts the tenant's admins; correct the users docs on associate_by_email/is_verified_by_default. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4
Warning text and design doc match the canonical, non-consumers GUID rule. Claude-Session: https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4
Deploying simple-module-python with
|
| Latest commit: |
ca32507
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://ebef5ddb.simple-module-python.pages.dev |
| Branch Preview URL: | https://feat-issue-873-entra-tenant.simple-module-python.pages.dev |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
oauth_microsoft_trust_tenant_upn, off by default. Today Microsoft sign-in never treats the user's email as verified, so on a site with self-signup closed nobody can sign in with Microsoft. With this setting on andoauth_microsoft_tenantset to a canonical tenant GUID, a member account'suserPrincipalNamecounts as a verified email. The first Microsoft sign-in then links to an invited or verified local account with that address.#EXT#), an empty Graph id or UPN,common/organizations/consumers, Microsoft's consumers tenant GUID, a domain-name tenant, or a non-canonical GUID. In those cases the setting does nothing, and with it on ausers.oauth.microsoft_trust_ignoredwarning is logged. Themailattribute is never used.api.pyis unchanged: the unproven-account guard (OAUTH_ACCOUNT_NOT_VERIFIED) and theallow_signupgate still apply. Signup withoutallow_signupis users: SSO account provisioning is tied to local self-signup (allow_signup); add a provider-scoped setting #874.docs/modules/users.mdand the CHANGELOG. They include a note that turning this on trusts the tenant's admins, who can set any member's UPN. I also corrected a stale claim indocs/modules/users.mdthatassociate_by_emailis always on.docs/superpowers/specs/2026-11-11-entra-tenant-upn-trust-design.md.Closes #873
Verification
allow_signup=False. The flow tests cover an invited account, a verified account, trust off, an unproven account and a guest.make lintpasses,make test-pyhas 8347 passed and 28 skipped,make test-jshas 906 passed.Test plan
https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4