TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-12-23 08:16:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(login): Add Organization Scoping to IDP Auto-Linking (#10931)

Browse Source 
This PR fixes an issue in the IDP auto-linking feature where user
searches were performed globally instead of being scoped to the current
organization context. This could result in IDP links being created for
users in unintended organizations.

# Which Problems Are Solved

When IDP auto-linking was enabled (by email or username), the system
would search for existing users across all organizations instead of
restricting the search to the current organization context.

# How the Problems Are Solved

Added organization scoping to all three auto-linking code paths
This commit is contained in:
Max Peintner
2025-10-21 10:56:34 +02:00
committed by GitHub
parent 6c98559ec0
commit 2ad5cf141f
1 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
apps/login/src/app/(login)/idp/[provider]/success/page.tsx
View File

@@ -179,22 +179,21 @@ export default async function Page(props: {
const email = addHumanUser?.email?.email; const email = addHumanUser?.email?.email;
if (options.autoLinking === AutoLinkingOption.EMAIL && email) { if (options.autoLinking === AutoLinkingOption.EMAIL && email) {
foundUser = await listUsers({ serviceUrl, email }).then((response) => { foundUser = await listUsers({ serviceUrl, email, organizationId: organization }).then((response) => {
return response.result ? response.result[0] : null; return response.result ? response.result[0] : null;
}); });
} else if (options.autoLinking === AutoLinkingOption.USERNAME) { } else if (options.autoLinking === AutoLinkingOption.USERNAME) {
foundUser = await listUsers( foundUser = await listUsers({ serviceUrl, userName: idpInformation.userName, organizationId: organization }).then(
options.autoLinking === AutoLinkingOption.USERNAME (response) => {
? { serviceUrl, userName: idpInformation.userName } return response.result ? response.result[0] : null;
: { serviceUrl, email }, },
).then((response) => { );
return response.result ? response.result[0] : null;
});
} else { } else {
foundUser = await listUsers({ foundUser = await listUsers({
serviceUrl, serviceUrl,
userName: idpInformation.userName, userName: idpInformation.userName,
email, email,
organizationId: organization,
}).then((response) => { }).then((response) => {
return response.result ? response.result[0] : null; return response.result ? response.result[0] : null;
}); });