bug: Prisma adapter crashes on SSO login when IdP returns non-standard tokens (e.g., session_token)
Describe the bug
When configuring SSO (using either the custom provider or built-in ones like keycloak), if the external Identity Provider (IdP) returns non-standard fields in the OAuth token response, authentication fails completely.
Specifically, NextAuth passes the entire token response payload to the Prisma Adapter. Because Prisma strictly validates against schema.prisma, if the IdP includes a field that isn't mapped to a column in the Account model (in my case, session_token), Prisma throws an Unknown argument error and the login crashes.
Steps to reproduce
Configure SSO using an Identity Provider that injects proprietary fields into the OIDC token response (e.g., Custom IDP, which injects session_token). Attempt to log in via SSO. The OAuth callback succeeds, but the system crashes when attempting to link/create the account in the database. Expected behavior Langfuse/NextAuth should either:
Automatically sanitize the token payload before passing it to the Prisma adapter (stripping out unknown/non-standard OIDC fields). Allow a way to map or ignore custom token fields in the configuration without requiring users to fork the repository and manually update schema.prisma.
Error Logs
langfuse-web-1 | Invalid `prisma.account.create()` invocation:
langfuse-web-1 |
langfuse-web-1 | {
langfuse-web-1 | data: {
langfuse-web-1 | provider: "keycloak", // (or "custom")
langfuse-web-1 | type: "oauth",
langfuse-web-1 | providerAccountId: "...",
langfuse-web-1 | access_token: "...",
langfuse-web-1 | token_type: "Bearer",
langfuse-web-1 | expires_at: 1789675303,
langfuse-web-1 | id_token: "...",
langfuse-web-1 | session_token: "...",
langfuse-web-1 | ~~~~~~~~~~~~~
langfuse-web-1 | scope: "urn:iam:m.me openid profile email",
langfuse-web-1 | session_state: "...",
langfuse-web-1 | userId: "..."
langfuse-web-1 | }
langfuse-web-1 | }
langfuse-web-1 |
langfuse-web-1 | Unknown argument `session_token`. Available options are marked with ?.
langfuse-web-1 | error [NEXT_AUTH] adapter_error_linkAccount
langfuse-web-1 | error [NEXT_AUTH] OAUTH_CALLBACK_HANDLER_ERROR```
### Langfuse Cloud or self-hosted?
Self-hosted
### If self-hosted, what version are you running?
_No response_
### SDK and integration versions
_No response_
### Additional information
_No response_
### Are you interested in contributing a fix for this bug?
NoSource: langfuse/langfuse