SCIM-provisioned users cannot sign in through SSO (account_not_linked)

[Vinho0oNguyen]

To Reproduce

1. On Dokploy Enterprise, configure SCIM provisioning and an OIDC SSO provider for the same identity provider and organization.
2. Provision a new user through SCIM.
3. Sign in through the SSO provider using the same email address.
4. The OAuth callback redirects with error=account_not_linked.

This is especially easy to reproduce with Microsoft Entra ID because its OIDC UserInfo response does not include email_verified.

Current vs. Expected behavior

Current: SCIM creates the Dokploy user without a verified-email state. Better Auth then refuses to link the SSO account to that existing user. The SSO plugin also does not treat trustedProviders as sufficient trust for this callback, so setting the provider as trusted in Dokploy does not resolve it.

Expected: A user provisioned by SCIM should be able to sign in through the corresponding SSO provider without manually creating or linking a second account. Any fix must retain Better Auths protection against linking an unrelated unverified identity by email.

Provide environment information

• Operating System: Linux amd64
• Dokploy version: v0.29.13
• Installation type: Enterprise self-hosted
• Authentication: SCIM 2.0 plus OIDC SSO (reproduced with Microsoft Entra ID)

Root-cause notes

• The SCIM plugin creates users through internalAdapter.createUser({ email, name }) and the resulting local user is not email-verified.
• Better Auths OAuth account-linking guard returns ACCOUNT_NOT_LINKED when the existing user or incoming identity is not verified/trusted.
• Dokploy currently enables sso({ trustEmailVerified: true }), but Entra UserInfo does not provide the email_verified claim.

Acceptance criteria

• A regression test covers SCIM provisioning followed by SSO login for the same managed identity.
• The SSO account is linked to the SCIM-provisioned Dokploy user.
• An unrelated or untrusted SSO identity still cannot take over an existing account by matching its email.
• Existing SSO-only and SCIM-only flows keep working.

Which area(s) are affected?

Enterprise authentication (SCIM / SSO)

Additional context

I am preparing a PR with a focused fix and regression coverage.

Will you send a PR to fix it?

Yes.

[linear-code]

DOK-611