agent foundation

lib/Service/Auth/SsoUserLinkService.php

@@ -35,6 +35,8 @@ class SsoUserLinkService
         }
 
         $providerKey = $this->tenantSsoGateway->microsoftProviderKey();
+        // Look up by OID first (stable Microsoft object ID), fall back to issuer+subject
+        // to handle tenants that migrated from an older OIDC setup without OID.
         $identity = $this->externalIdentityGateway->findByProviderTidOid(
             $providerKey,
             $tid,
@@ -257,6 +259,8 @@ class SsoUserLinkService
         return $locale;
     }
 
+    // SSO users never log in with a password, but the DB column is NOT NULL.
+    // The suffix ensures the hash satisfies any strength validators.
     private function randomPassword(): string
     {
         return 'sso-' . bin2hex(random_bytes(24)) . '-A1!';