Microsoft Connection fails when connecting an account with the same email as an existing Google account

Checklist

• I could not find a solution in the existing issues or docs.
• I agree to follow this project's Code of Conduct.

Describe the bug

We have configured Google and Microsoft as separate Social Connections clients.

The problem occurs when a user has already signed up using Google with email A, and then tries to connect their Microsoft account, which also uses email A, from their profile.

Instead of connecting the Microsoft identity to the existing Hanko user, the OAuth flow fails with:

oauth-callback?error=server_error&error_description=an+internal+error+has+occurred

Now we see the identity among the user.emails.identities but not in the user.identities.

Social Connection configuration

There is nothing particularly unusual about the OAuth clients.

For Google, we essentially only configured the required redirect URL pointing to our Hanko Cloud URL.

For Microsoft, in addition to the redirect URL, we configured the following optional claims:

• email
• family_name
• given_name
• upn
• xms_edov

Additional testing

We have done several tests to determine whether this is related to the OAuth client configuration or a specific tenant.

Disabling the xms_edov

We tried to disable the xms_edov claim in the Microsoft client to see if it has any effect, no effect at all.

Different Microsoft account

While logged in using the Google account with email A:

• Connecting Microsoft account A → fails
• Connecting Microsoft account B, with a different email → works
• We then disconnected Microsoft account B
• Trying Microsoft account A again → still fails

This suggests that the Microsoft OAuth configuration itself is working correctly, and that the failure may be related specifically to connecting two identities that use the same email address.

Different Hanko Cloud tenant

We also reproduced the exact same setup and steps in a completely different Hanko Cloud tenant, using different accounts/tenant data but again having the Google and Microsoft accounts use the same email address.

The result was the same: connecting Microsoft with the same email as the existing Google identity fails with server_error.

---

We can provide tenant information and timestamps of recent failed attempts if that helps you locate the corresponding server-side logs.

Reproducing the bug

1. Configure Google and Microsoft as Social Connections.
2. Create/sign up for a Hanko account using Google account A.
3. Open the user's profile.
4. Select the option to connect a Microsoft account.
5. Authenticate with Microsoft account A, where the Microsoft account uses the same email address as the Google account.
6. The OAuth callback fails with: error=server_error error_description=an internal error has occurred

Hanko Version

Hanko Cloud - v3.0.4

Environment

• Hanko Cloud: v3.0.4
• Hanko Frontend SDK: v3.0.0
• Using the Flow API
• Custom forms
• Multiple Social Connections clients configured