Exploring PP with MitID and Entra

[1iveowl]

Hi @tjementum,

I’ve been exploring PP out of curiosity. It’s been on my list to dig into what you’ve been working on here, and I finally had some time to play with it these past days.

To kick the tires, I added MitID verification and login after verification, plus Entra signup and login.

To support this, I changed how external identities are stored and used: I moved them from the existing user JSON into a dedicated table and made linked-account lookup use stable provider IDs first, with a verified-email fallback where appropriate. This lets accounts remain linked when an email changes or isn’t supplied, as with MitID.

Existing Google identities are migrated. I chose a separate table to make provider-ID lookups straightforward and let the database enforce unique identity bindings within each tenant, accepting the extra migration work that comes with it.

The stable-ID lookup also matters for Entra: Microsoft advises against using email as a durable user identifier, since addresses can change or be reassigned. I use Entra’s tenant and object IDs (tid + oid) to identify the linked account.

I chose a separate table to make provider-ID lookups straightforward and let the database enforce unique identity bindings within each tenant, accepting the extra migration work that comes with it.

I didn’t open a discussion here first because this started as an experiment, without any upfront plan to add or change anything to the core of PlatformPlatform.

If this made you curious, you could have a look at the foundational change. I’d also be happy to open a PR if you’d like.

The subsequent branches add Entra, MitID verification, and MitID login, in that order.

It’s clear how much thought and work that has put into PlatformPlatform, and I’m enjoying getting to know it!