{"record":{"id":"d1e37c7cc1355b98","repo":"medusajs/medusa","slug":"the-identity-provider-did-not-confirm-a-verified-e","errorCode":null,"errorMessage":"The identity provider did not confirm a verified email address","messagePattern":"The identity provider did not confirm a verified email address","errorType":"exception","errorClass":"MedusaError","httpStatus":400,"severity":"error","filePath":"packages/modules/providers/auth-oidc/src/engine/engine.ts","lineNumber":231,"sourceCode":"    const entityIdValue = claims[entityIdClaim]\n\n    if (\n      entityIdValue === undefined ||\n      entityIdValue === null ||\n      entityIdValue === \"\"\n    ) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        `The identity provider's ID token is missing the '${entityIdClaim}' claim used to identify the user`\n      )\n    }\n\n    const emailClaim = mappings.email ?? \"email\"\n    const email = claims[emailClaim]\n\n    const requireVerifiedEmail = this.options_.require_verified_email ?? true\n    if (requireVerifiedEmail && claims.email_verified !== true) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"The identity provider did not confirm a verified email address\"\n      )\n    }\n\n    if (this.options_.allowed_email_domains?.length) {\n      const allowedDomains = this.options_.allowed_email_domains.map((domain) =>\n        domain.toLowerCase()\n      )\n      const domain =\n        typeof email === \"string\"\n          ? email.split(\"@\")[1]?.toLowerCase()\n          : undefined\n\n      if (!domain || !allowedDomains.includes(domain)) {\n        throw new MedusaError(\n          MedusaError.Types.UNAUTHORIZED,\n          \"The email domain is not allowed to authenticate with this provider\"","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/providers/auth-oidc/src/engine/engine.ts#L213-L249","documentation":"By default (require_verified_email defaults to true), the engine requires claims.email_verified === true in the ID token. If the IdP does not assert a verified email, authentication is rejected with INVALID_DATA even though the token itself is valid.","triggerScenarios":"The IdP emits email but not email_verified (common with some providers/mappers); email_verified is false or a non-boolean truthy value; the email claim mapping points at a custom claim without a corresponding verified flag.","commonSituations":"Keycloak or self-hosted IdPs where email verification is not enforced so the claim is absent; development/test users created directly in the IdP admin without verified email; custom email claim mapping that bypasses the standard email_verified claim.","solutions":["Verify/confirm the user's email in the identity provider so it asserts email_verified: true.","If your IdP does not track verification and you accept that risk, set require_verified_email: false in the provider options.","Ensure the standard 'email' scope is requested so email/email_verified are emitted, and that a custom email mapping has a matching verified claim path."],"exampleFix":"// before\noptions: { issuer: \"...\", client_id: \"...\", callback_url: \"...\" } // defaults to requiring verified email\n// after\noptions: { issuer: \"...\", client_id: \"...\", callback_url: \"...\", require_verified_email: false }","handlingStrategy":"validation","validationCode":"const requireVerified = options.require_verified_email ?? true\nif (requireVerified) {\n  // verify in the IdP that your test users have confirmed emails\n  // or explicitly opt out: require_verified_email: false\n}","typeGuard":"const isVerifiedEmail = (claims: Record<string, unknown>): boolean =>\n  claims.email_verified === true","tryCatchPattern":"try { engine.mapClaims(claims) } catch (e) { if (e instanceof MedusaError && /verified email/.test(e.message)) { /* prompt user to verify email at IdP, or disable requirement */ } throw e }","preventionTips":["Pre-verify test users' emails in the IdP.","Set require_verified_email: false only when the IdP cannot assert it.","Request the 'email' scope so email/email_verified are emitted."],"tags":["oidc","email-verification","claims","security"],"backgroundTag":"email-not-verified","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}