The configuration matches that of the documentation; When I create an identity, and register via SSO (GSuite), the email in the

trait

matches the

verfied_address

value, but the identity always remains unverified.

select traits from identities where id = '32217327-951d-xxxx-xxxx-711a0c21e603' limit 10;
                                              traits
---------------------------------------------------------------------------------------------------
 {"hd": "<snip>.com", "sub": "<snip>", "email": "adam.strawson@<snip>.com"}

select verified, value from identity_verifiable_addresses where identity_id = '32217327-951d-xxxx-xxxx-711a0c21e603';
 verified |            value
----------+------------------------------
 f        | adam.strawson@<snip>.com
(1 row)

Am I missing something here, or is the documentation missing something?

I think I've solved this, although not sure if it's an edge case bug.. for me, the identity already existed (from an old user/pass registration), and so the newer OIDC Registration flow never updates the existing entry in verifiable addressed. (Should it?)