Greptile Summary

This PR fixes a correctness bug where SCIM-provisioned users were created with authMethod: "LOCAL" (the Prisma schema default), causing their subsequent OIDC login attempts to be rejected with a "local account exists" error. The one-line fix adds authMethod: "OIDC" to the prisma.user.create call in scimCreateUser, aligning SCIM provisioning with the intended SSO-only authentication model and unblocking OIDC group sync on first login.

Key observations:

• The core fix is correct and minimal — newly SCIM-provisioned users will now have authMethod: "OIDC" and can authenticate via SSO immediately.
• Adoption path gap: The adoption update (lines 120–126), which handles users that already exist when a SCIM create arrives, only updates scimExternalId and does not update authMethod. This means users who were SCIM-provisioned before this fix (with authMethod: "LOCAL" from the old default) remain blocked even after an IdP re-sync triggers the adoption branch. The OIDC login blocking logic in auth.ts (lines 229–241) explicitly rejects OIDC sign-in for authMethod: "LOCAL" accounts, confirming that this scenario is a real blocker. Adding authMethod: "OIDC" to the adoption update would self-heal those accounts without a separate data migration.
• No security regression is introduced: the OIDC-vs-LOCAL blocking logic in auth.ts is unchanged, and the randomly generated temp password for SCIM users remains inaccessible for local login.

Confidence Score: 3/5

• Safe to merge for new provisioning, but existing SCIM users with authMethod: "LOCAL" remain broken without an adoption path fix or manual migration.
• The one-line change is correct and doesn't introduce regressions. However, the adoption path gap means the fix is incomplete for any deployment that already has SCIM-provisioned users. Those users still can't log in via OIDC after a re-sync, which is the stated goal of the PR. The issue is real and verified: the adoption condition (line 110) allows users with pre-existing scimExternalId through regardless of authMethod, and auth.ts explicitly blocks OIDC login for LOCAL accounts (lines 229–241).
• src/server/services/scim.ts — specifically the adoption update block (lines 120–126) which should also set authMethod: "OIDC"

_{Last reviewed commit: 072964e}