Unverified50% confidenceSolutionExact time
After successful just-in-time provisioning, the binding between a stable identifier on the identity provider side (such as the OIDC sub or the SAML NameID) and the local user should be stored, to avoid re-matching by email on every login.
1
Sources
50%
Confidence
Long-term
Relevance
11/4/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedAn identity assertion is structured data issued by the identity provider in an SSO callback, usually appearing in the form of a SAML assertion or an OIDC ID Token.72% similarUnverifiedGoogle usually requires email verification before login, while the OIDC implementations of some self-hosted or niche providers allow users to set any unverified email; this inconsistency in verification policies across providers gives attackers an opportunity.71% similarVerifiedMany online services do not enforce an email verification process during user registration, allowing users to complete registration with an email address that does not belong to them.70% similarUnverifiedWhen an identity provider issues an Access Token, it encodes the user's roles, permissions, and organizational affiliation at the moment of issuance, and the token's content remains fixed for its validity period unless it expires or is actively revoked.70% similarUnverifiedUsers arbitrage the reciprocal credit mechanism by bulk-creating temporary mailboxes to receive verification codes and password reset emails in order to accumulate inbound credits.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1134493API
curl https://kongchang.com/api/v1/knowledge/claims/1134493MCP
get_claim(id=1134493)