From 0109427d04fe9764c00e198128e773bccada8cea Mon Sep 17 00:00:00 2001
From: Pedro Castro <pedro@cal.com>
Date: Mon, 5 Jan 2026 11:00:11 -0300
Subject: [PATCH] fix(auth): make identityProviderId lookup case-insensitive
 (#26405)

SAML IdPs may send NameIDs with different casing than stored, causing login failures.
Aligns with the existing case-insensitive email lookup pattern
---
 packages/features/auth/lib/next-auth-options.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/features/auth/lib/next-auth-options.ts b/packages/features/auth/lib/next-auth-options.ts
index 41c01f2aac..449d17a7e9 100644
--- a/packages/features/auth/lib/next-auth-options.ts
+++ b/packages/features/auth/lib/next-auth-options.ts
@@ -865,7 +865,10 @@ export const getOptions = ({
           },
           where: {
             identityProvider: idP,
-            identityProviderId: account.providerAccountId,
+            identityProviderId: {
+              equals: account.providerAccountId,
+              mode: "insensitive",
+            },
           },
         });