feat: allow domain discovery for unknown usernames (#4484)

* fix: wait for projection initialization to be done * feat: allow domain discovery for unknown usernames * fix linting * Update console/src/assets/i18n/de.json Co-authored-by: Fabi <38692350+hifabienne@users.noreply.github.com> * Update console/src/assets/i18n/en.json Co-authored-by: Fabi <38692350+hifabienne@users.noreply.github.com> * Update console/src/assets/i18n/it.json Co-authored-by: Fabi <38692350+hifabienne@users.noreply.github.com> * Update console/src/assets/i18n/fr.json Co-authored-by: Fabi <38692350+hifabienne@users.noreply.github.com> * fix zh i18n text * fix projection table name Co-authored-by: Fabi <38692350+hifabienne@users.noreply.github.com>
2025-08-12 07:47:32 +00:00 · 2022-10-06 13:30:14 +02:00
parent ce22961d8e
commit bffb10a4b4
46 changed files with 519 additions and 370 deletions
--- a/internal/command/instance.go
+++ b/internal/command/instance.go
@@ -71,6 +71,7 @@ type InstanceSetup struct {
 		ForceMFA                   bool
 		HidePasswordReset          bool
 		IgnoreUnknownUsername      bool
+		AllowDomainDiscovery       bool
 		PasswordlessType           domain.PasswordlessType
 		DefaultRedirectURI         string
 		PasswordCheckLifetime      time.Duration
@@ -217,6 +218,7 @@ func (c *Commands) SetUpInstance(ctx context.Context, setup *InstanceSetup) (str
 			setup.LoginPolicy.ForceMFA,
 			setup.LoginPolicy.HidePasswordReset,
 			setup.LoginPolicy.IgnoreUnknownUsername,
+			setup.LoginPolicy.AllowDomainDiscovery,
 			setup.LoginPolicy.PasswordlessType,
 			setup.LoginPolicy.DefaultRedirectURI,
 			setup.LoginPolicy.PasswordCheckLifetime,
--- a/internal/command/instance_converter.go
+++ b/internal/command/instance_converter.go
@@ -32,6 +32,7 @@ func writeModelToLoginPolicy(wm *LoginPolicyWriteModel) *domain.LoginPolicy {
 		AllowExternalIDP:           wm.AllowExternalIDP,
 		HidePasswordReset:          wm.HidePasswordReset,
 		IgnoreUnknownUsernames:     wm.IgnoreUnknownUsernames,
+		AllowDomainDiscovery:       wm.AllowDomainDiscovery,
 		ForceMFA:                   wm.ForceMFA,
 		PasswordlessType:           wm.PasswordlessType,
 		DefaultRedirectURI:         wm.DefaultRedirectURI,
--- a/internal/command/instance_policy_login.go
+++ b/internal/command/instance_policy_login.go
@@ -15,37 +15,6 @@ import (
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 )

-func (c *Commands) AddDefaultLoginPolicy(
-	ctx context.Context,
-	allowUsernamePassword, allowRegister, allowExternalIDP, forceMFA, hidePasswordReset, ignoreUnknownUsernames bool,
-	passwordlessType domain.PasswordlessType,
-	defaultRedirectURI string,
-	passwordCheckLifetime, externalLoginCheckLifetime, mfaInitSkipLifetime, secondFactorCheckLifetime, multiFactorCheckLifetime time.Duration,
-) (*domain.ObjectDetails, error) {
-	instanceAgg := instance.NewAggregate(authz.GetInstance(ctx).InstanceID())
-	cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, prepareAddDefaultLoginPolicy(instanceAgg, allowUsernamePassword,
-		allowRegister,
-		allowExternalIDP,
-		forceMFA,
-		hidePasswordReset,
-		ignoreUnknownUsernames,
-		passwordlessType,
-		defaultRedirectURI,
-		passwordCheckLifetime,
-		externalLoginCheckLifetime,
-		mfaInitSkipLifetime,
-		secondFactorCheckLifetime,
-		multiFactorCheckLifetime))
-	if err != nil {
-		return nil, err
-	}
-	pushedEvents, err := c.eventstore.Push(ctx, cmds...)
-	if err != nil {
-		return nil, err
-	}
-	return pushedEventsToObjectDetails(pushedEvents), nil
-}
-
 func (c *Commands) ChangeDefaultLoginPolicy(ctx context.Context, policy *domain.LoginPolicy) (*domain.LoginPolicy, error) {
 	existingPolicy := NewInstanceLoginPolicyWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&existingPolicy.LoginPolicyWriteModel.WriteModel)
@@ -83,6 +52,7 @@ func (c *Commands) changeDefaultLoginPolicy(ctx context.Context, instanceAgg *ev
 		policy.ForceMFA,
 		policy.HidePasswordReset,
 		policy.IgnoreUnknownUsernames,
+		policy.AllowDomainDiscovery,
 		policy.PasswordlessType,
 		policy.DefaultRedirectURI,
 		policy.PasswordCheckLifetime,
@@ -293,6 +263,7 @@ func prepareAddDefaultLoginPolicy(
 	forceMFA bool,
 	hidePasswordReset bool,
 	ignoreUnknownUsernames bool,
+	allowDomainDiscovery bool,
 	passwordlessType domain.PasswordlessType,
 	defaultRedirectURI string,
 	passwordCheckLifetime time.Duration,
@@ -323,6 +294,7 @@ func prepareAddDefaultLoginPolicy(
 					forceMFA,
 					hidePasswordReset,
 					ignoreUnknownUsernames,
+					allowDomainDiscovery,
 					passwordlessType,
 					defaultRedirectURI,
 					passwordCheckLifetime,
--- a/internal/command/instance_policy_login_model.go
+++ b/internal/command/instance_policy_login_model.go
@@ -66,7 +66,8 @@ func (wm *InstanceLoginPolicyWriteModel) NewChangedEvent(
 	allowExternalIDP,
 	forceMFA,
 	hidePasswordReset,
-	ignoreUnknownUsernames bool,
+	ignoreUnknownUsernames,
+	allowDomainDiscovery bool,
 	passwordlessType domain.PasswordlessType,
 	defaultRedirectURI string,
 	passwordCheckLifetime,
@@ -98,6 +99,9 @@ func (wm *InstanceLoginPolicyWriteModel) NewChangedEvent(
 	if wm.IgnoreUnknownUsernames != ignoreUnknownUsernames {
 		changes = append(changes, policy.ChangeIgnoreUnknownUsernames(ignoreUnknownUsernames))
 	}
+	if wm.AllowDomainDiscovery != allowDomainDiscovery {
+		changes = append(changes, policy.ChangeAllowDomainDiscovery(allowDomainDiscovery))
+	}
 	if wm.DefaultRedirectURI != defaultRedirectURI {
 		changes = append(changes, policy.ChangeDefaultRedirectURI(defaultRedirectURI))
 	}
--- a/internal/command/instance_policy_login_test.go
+++ b/internal/command/instance_policy_login_test.go
@@ -18,161 +18,6 @@ import (
 	"github.com/stretchr/testify/assert"
 )

-func TestCommandSide_AddDefaultLoginPolicy(t *testing.T) {
-	type fields struct {
-		eventstore *eventstore.Eventstore
-	}
-	type args struct {
-		ctx                        context.Context
-		allowUsernamePassword      bool
-		allowRegister              bool
-		allowExternalIDP           bool
-		forceMFA                   bool
-		hidePasswordReset          bool
-		ignoreUnknownUsernames     bool
-		passwordlessType           domain.PasswordlessType
-		defaultRedirectURI         string
-		passwordCheckLifetime      time.Duration
-		externalLoginCheckLifetime time.Duration
-		mfaInitSkipLifetime        time.Duration
-		secondFactorCheckLifetime  time.Duration
-		multiFactorCheckLifetime   time.Duration
-	}
-	type res struct {
-		want *domain.ObjectDetails
-		err  func(error) bool
-	}
-	tests := []struct {
-		name   string
-		fields fields
-		args   args
-		res    res
-	}{
-		{
-			name: "loginpolicy already existing, already exists error",
-			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-					expectFilter(
-						eventFromEventPusher(
-							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate("INSTANCE").Aggregate,
-								true,
-								true,
-								false,
-								false,
-								false,
-								false,
-								domain.PasswordlessTypeAllowed,
-								"",
-								time.Hour*1,
-								time.Hour*1,
-								time.Hour*1,
-								time.Hour*1,
-								time.Hour*1,
-							),
-						),
-					),
-				),
-			},
-			args: args{
-				ctx:                   context.Background(),
-				allowRegister:         true,
-				allowUsernamePassword: true,
-				passwordlessType:      domain.PasswordlessTypeAllowed,
-			},
-			res: res{
-				err: caos_errs.IsErrorAlreadyExists,
-			},
-		},
-		{
-			name: "add policy,ok",
-			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-					expectFilter(),
-					expectPush(
-						[]*repository.Event{
-							eventFromEventPusherWithInstanceID(
-								"INSTANCE",
-								instance.NewLoginPolicyAddedEvent(context.Background(),
-									&instance.NewAggregate("INSTANCE").Aggregate,
-									true,
-									true,
-									true,
-									true,
-									true,
-									true,
-									domain.PasswordlessTypeAllowed,
-									"https://example.com/redirect",
-									time.Hour*1,
-									time.Hour*2,
-									time.Hour*3,
-									time.Hour*4,
-									time.Hour*5,
-								),
-							),
-						},
-					),
-				),
-			},
-			args: args{
-				ctx:                        authz.WithInstanceID(context.Background(), "INSTANCE"),
-				allowRegister:              true,
-				allowUsernamePassword:      true,
-				allowExternalIDP:           true,
-				forceMFA:                   true,
-				hidePasswordReset:          true,
-				ignoreUnknownUsernames:     true,
-				passwordlessType:           domain.PasswordlessTypeAllowed,
-				defaultRedirectURI:         "https://example.com/redirect",
-				passwordCheckLifetime:      time.Hour * 1,
-				externalLoginCheckLifetime: time.Hour * 2,
-				mfaInitSkipLifetime:        time.Hour * 3,
-				secondFactorCheckLifetime:  time.Hour * 4,
-				multiFactorCheckLifetime:   time.Hour * 5,
-			},
-			res: res{
-				want: &domain.ObjectDetails{
-					ResourceOwner: "INSTANCE",
-				},
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			r := &Commands{
-				eventstore: tt.fields.eventstore,
-			}
-			got, err := r.AddDefaultLoginPolicy(
-				tt.args.ctx,
-				tt.args.allowUsernamePassword,
-				tt.args.allowRegister,
-				tt.args.allowExternalIDP,
-				tt.args.forceMFA,
-				tt.args.hidePasswordReset,
-				tt.args.ignoreUnknownUsernames,
-				tt.args.passwordlessType,
-				tt.args.defaultRedirectURI,
-				tt.args.passwordCheckLifetime,
-				tt.args.externalLoginCheckLifetime,
-				tt.args.mfaInitSkipLifetime,
-				tt.args.secondFactorCheckLifetime,
-				tt.args.multiFactorCheckLifetime,
-			)
-			if tt.res.err == nil {
-				assert.NoError(t, err)
-			}
-			if tt.res.err != nil && !tt.res.err(err) {
-				t.Errorf("got wrong err: %v ", err)
-			}
-			if tt.res.err == nil {
-				assert.Equal(t, tt.res.want, got)
-			}
-		})
-	}
-}
-
 func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 	type fields struct {
 		eventstore *eventstore.Eventstore
@@ -225,6 +70,7 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"https://example.com/redirect",
 								time.Hour*1,
@@ -246,6 +92,7 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 					ForceMFA:                   true,
 					HidePasswordReset:          true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -275,6 +122,7 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"https://example.com/redirect",
 								time.Hour*1,
@@ -296,6 +144,7 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 									false,
 									false,
 									false,
+									false,
 									domain.PasswordlessTypeNotAllowed,
 									"",
 									time.Hour*10,
@@ -317,6 +166,7 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 					ForceMFA:                   false,
 					HidePasswordReset:          false,
 					IgnoreUnknownUsernames:     false,
+					AllowDomainDiscovery:       false,
 					PasswordlessType:           domain.PasswordlessTypeNotAllowed,
 					DefaultRedirectURI:         "",
 					PasswordCheckLifetime:      time.Hour * 10,
@@ -339,6 +189,7 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 					ForceMFA:                   false,
 					HidePasswordReset:          false,
 					IgnoreUnknownUsernames:     false,
+					AllowDomainDiscovery:       false,
 					PasswordlessType:           domain.PasswordlessTypeNotAllowed,
 					DefaultRedirectURI:         "",
 					PasswordCheckLifetime:      time.Hour * 10,
@@ -435,6 +286,7 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -473,6 +325,7 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -531,6 +384,7 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -671,6 +525,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -709,6 +564,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -760,6 +616,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -816,6 +673,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -880,6 +738,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -1434,7 +1293,7 @@ func TestCommandSide_RemoveMultiFactorDefaultLoginPolicy(t *testing.T) {
 	}
 }

-func newDefaultLoginPolicyChangedEvent(ctx context.Context, allowRegister, allowUsernamePassword, allowExternalIDP, forceMFA, hidePasswordReset, ignoreUnknownUsernames bool,
+func newDefaultLoginPolicyChangedEvent(ctx context.Context, allowRegister, allowUsernamePassword, allowExternalIDP, forceMFA, hidePasswordReset, ignoreUnknownUsernames, allowDomainDiscovery bool,
 	passwordlessType domain.PasswordlessType,
 	redirectURI string,
 	passwordLifetime, externalLoginLifetime, mfaInitSkipLifetime, secondFactorLifetime, multiFactorLifetime time.Duration) *instance.LoginPolicyChangedEvent {
@@ -1447,6 +1306,7 @@ func newDefaultLoginPolicyChangedEvent(ctx context.Context, allowRegister, allow
 			policy.ChangeAllowUserNamePassword(allowUsernamePassword),
 			policy.ChangeHidePasswordReset(hidePasswordReset),
 			policy.ChangeIgnoreUnknownUsernames(ignoreUnknownUsernames),
+			policy.ChangeAllowDomainDiscovery(allowDomainDiscovery),
 			policy.ChangePasswordlessType(passwordlessType),
 			policy.ChangeDefaultRedirectURI(redirectURI),
 			policy.ChangePasswordCheckLifetime(passwordLifetime),
--- a/internal/command/org_policy_login.go
+++ b/internal/command/org_policy_login.go
@@ -39,6 +39,7 @@ func (c *Commands) AddLoginPolicy(ctx context.Context, resourceOwner string, pol
 			policy.ForceMFA,
 			policy.HidePasswordReset,
 			policy.IgnoreUnknownUsernames,
+			policy.AllowDomainDiscovery,
 			policy.PasswordlessType,
 			policy.DefaultRedirectURI,
 			policy.PasswordCheckLifetime,
@@ -127,6 +128,7 @@ func (c *Commands) ChangeLoginPolicy(ctx context.Context, resourceOwner string,
 		policy.ForceMFA,
 		policy.HidePasswordReset,
 		policy.IgnoreUnknownUsernames,
+		policy.AllowDomainDiscovery,
 		policy.PasswordlessType,
 		policy.DefaultRedirectURI,
 		policy.PasswordCheckLifetime,
--- a/internal/command/org_policy_login_model.go
+++ b/internal/command/org_policy_login_model.go
@@ -68,7 +68,8 @@ func (wm *OrgLoginPolicyWriteModel) NewChangedEvent(
 	allowExternalIDP,
 	forceMFA,
 	hidePasswordReset,
-	ignoreUnknownUsernames bool,
+	ignoreUnknownUsernames,
+	allowDomainDiscovery bool,
 	passwordlessType domain.PasswordlessType,
 	defaultRedirectURI string,
 	passwordCheckLifetime,
@@ -97,6 +98,9 @@ func (wm *OrgLoginPolicyWriteModel) NewChangedEvent(
 	if wm.IgnoreUnknownUsernames != ignoreUnknownUsernames {
 		changes = append(changes, policy.ChangeIgnoreUnknownUsernames(ignoreUnknownUsernames))
 	}
+	if wm.AllowDomainDiscovery != allowDomainDiscovery {
+		changes = append(changes, policy.ChangeAllowDomainDiscovery(allowDomainDiscovery))
+	}
 	if wm.PasswordCheckLifetime != passwordCheckLifetime {
 		changes = append(changes, policy.ChangePasswordCheckLifetime(passwordCheckLifetime))
 	}
--- a/internal/command/org_policy_login_test.go
+++ b/internal/command/org_policy_login_test.go
@@ -79,6 +79,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"https://example.com/redirect",
 								time.Hour*1,
@@ -100,6 +101,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					AllowExternalIDP:           true,
 					ForceMFA:                   true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -130,6 +132,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 									true,
 									true,
 									true,
+									true,
 									domain.PasswordlessTypeAllowed,
 									"https://example.com/redirect",
 									time.Hour*1,
@@ -153,6 +156,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					ForceMFA:                   true,
 					HidePasswordReset:          true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -174,6 +178,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					ForceMFA:                   true,
 					HidePasswordReset:          true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -202,6 +207,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					ForceMFA:                   true,
 					HidePasswordReset:          true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -233,6 +239,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 									true,
 									true,
 									true,
+									true,
 									domain.PasswordlessTypeAllowed,
 									"https://example.com/redirect",
 									time.Hour*1,
@@ -268,6 +275,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					ForceMFA:                   true,
 					HidePasswordReset:          true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -291,6 +299,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					ForceMFA:                   true,
 					HidePasswordReset:          true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -320,6 +329,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					ForceMFA:                   true,
 					HidePasswordReset:          true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -368,6 +378,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 									true,
 									true,
 									true,
+									true,
 									domain.PasswordlessTypeAllowed,
 									"https://example.com/redirect",
 									time.Hour*1,
@@ -398,6 +409,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					ForceMFA:                   true,
 					HidePasswordReset:          true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -425,6 +437,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					ForceMFA:                   true,
 					HidePasswordReset:          true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -489,6 +502,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 					AllowExternalIDP:       true,
 					ForceMFA:               true,
 					IgnoreUnknownUsernames: true,
+					AllowDomainDiscovery:   true,
 					PasswordlessType:       domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:     "https://example.com/redirect",
 				},
@@ -514,6 +528,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 					AllowExternalIDP:       true,
 					ForceMFA:               true,
 					IgnoreUnknownUsernames: true,
+					AllowDomainDiscovery:   true,
 					PasswordlessType:       domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:     "https://example.com/redirect",
 				},
@@ -537,6 +552,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"https://example.com/redirect",
 								time.Hour*1,
@@ -559,6 +575,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 					ForceMFA:                   true,
 					HidePasswordReset:          true,
 					IgnoreUnknownUsernames:     true,
+					AllowDomainDiscovery:       true,
 					PasswordlessType:           domain.PasswordlessTypeAllowed,
 					DefaultRedirectURI:         "https://example.com/redirect",
 					PasswordCheckLifetime:      time.Hour * 1,
@@ -587,6 +604,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"https://example.com/redirect",
 								time.Hour*1,
@@ -608,6 +626,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 									false,
 									false,
 									false,
+									false,
 									domain.PasswordlessTypeNotAllowed,
 									"",
 									&duration10,
@@ -630,6 +649,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 					AllowExternalIDP:           false,
 					ForceMFA:                   false,
 					IgnoreUnknownUsernames:     false,
+					AllowDomainDiscovery:       false,
 					PasswordlessType:           domain.PasswordlessTypeNotAllowed,
 					DefaultRedirectURI:         "",
 					PasswordCheckLifetime:      time.Hour * 10,
@@ -651,6 +671,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 					ForceMFA:                   false,
 					HidePasswordReset:          false,
 					IgnoreUnknownUsernames:     false,
+					AllowDomainDiscovery:       false,
 					PasswordlessType:           domain.PasswordlessTypeNotAllowed,
 					DefaultRedirectURI:         "",
 					PasswordCheckLifetime:      time.Hour * 10,
@@ -744,6 +765,7 @@ func TestCommandSide_RemoveLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -884,6 +906,7 @@ func TestCommandSide_AddIDPProviderLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -925,6 +948,7 @@ func TestCommandSide_AddIDPProviderLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -986,6 +1010,7 @@ func TestCommandSide_AddIDPProviderLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -1150,6 +1175,7 @@ func TestCommandSide_RemoveIDPProviderLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -1191,6 +1217,7 @@ func TestCommandSide_RemoveIDPProviderLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -1244,6 +1271,7 @@ func TestCommandSide_RemoveIDPProviderLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -1304,6 +1332,7 @@ func TestCommandSide_RemoveIDPProviderLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -1372,6 +1401,7 @@ func TestCommandSide_RemoveIDPProviderLoginPolicy(t *testing.T) {
 								true,
 								true,
 								true,
+								true,
 								domain.PasswordlessTypeAllowed,
 								"",
 								time.Hour*1,
@@ -1990,7 +2020,7 @@ func TestCommandSide_RemoveMultiFactorLoginPolicy(t *testing.T) {
 	}
 }

-func newLoginPolicyChangedEvent(ctx context.Context, orgID string, usernamePassword, register, externalIDP, mfa, passwordReset, ignoreUnknownUsernames bool,
+func newLoginPolicyChangedEvent(ctx context.Context, orgID string, usernamePassword, register, externalIDP, mfa, passwordReset, ignoreUnknownUsernames, allowDomainDiscovery bool,
 	passwordlessType domain.PasswordlessType,
 	redirectURI string,
 	passwordLifetime, externalLoginLifetime, mfaInitSkipLifetime, secondFactorLifetime, multiFactorLifetime *time.Duration) *org.LoginPolicyChangedEvent {
@@ -2001,6 +2031,7 @@ func newLoginPolicyChangedEvent(ctx context.Context, orgID string, usernamePassw
 		policy.ChangeForceMFA(mfa),
 		policy.ChangeHidePasswordReset(passwordReset),
 		policy.ChangeIgnoreUnknownUsernames(ignoreUnknownUsernames),
+		policy.ChangeAllowDomainDiscovery(allowDomainDiscovery),
 		policy.ChangePasswordlessType(passwordlessType),
 		policy.ChangeDefaultRedirectURI(redirectURI),
 	}
--- a/internal/command/policy_login_model.go
+++ b/internal/command/policy_login_model.go
@@ -17,6 +17,7 @@ type LoginPolicyWriteModel struct {
 	ForceMFA                   bool
 	HidePasswordReset          bool
 	IgnoreUnknownUsernames     bool
+	AllowDomainDiscovery       bool
 	PasswordlessType           domain.PasswordlessType
 	DefaultRedirectURI         string
 	PasswordCheckLifetime      time.Duration
@@ -38,6 +39,7 @@ func (wm *LoginPolicyWriteModel) Reduce() error {
 			wm.PasswordlessType = e.PasswordlessType
 			wm.HidePasswordReset = e.HidePasswordReset
 			wm.IgnoreUnknownUsernames = e.IgnoreUnknownUsernames
+			wm.AllowDomainDiscovery = e.AllowDomainDiscovery
 			wm.DefaultRedirectURI = e.DefaultRedirectURI
 			wm.PasswordCheckLifetime = e.PasswordCheckLifetime
 			wm.ExternalLoginCheckLifetime = e.ExternalLoginCheckLifetime
@@ -64,6 +66,9 @@ func (wm *LoginPolicyWriteModel) Reduce() error {
 			if e.IgnoreUnknownUsernames != nil {
 				wm.IgnoreUnknownUsernames = *e.IgnoreUnknownUsernames
 			}
+			if e.AllowDomainDiscovery != nil {
+				wm.AllowDomainDiscovery = *e.AllowDomainDiscovery
+			}
 			if e.PasswordlessType != nil {
 				wm.PasswordlessType = *e.PasswordlessType
 			}
--- a/internal/command/user_human_password_test.go
+++ b/internal/command/user_human_password_test.go
@@ -1157,6 +1157,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -1194,6 +1195,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -1232,6 +1234,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -1286,6 +1289,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -1374,6 +1378,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -1469,6 +1474,7 @@ func TestCommandSide_CheckPassword(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
--- a/internal/command/user_human_test.go
+++ b/internal/command/user_human_test.go
@@ -1679,6 +1679,7 @@ func TestCommandSide_RegisterHuman(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -1745,6 +1746,7 @@ func TestCommandSide_RegisterHuman(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -1811,6 +1813,7 @@ func TestCommandSide_RegisterHuman(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -1894,6 +1897,7 @@ func TestCommandSide_RegisterHuman(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -2035,6 +2039,7 @@ func TestCommandSide_RegisterHuman(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -2144,6 +2149,7 @@ func TestCommandSide_RegisterHuman(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -2247,6 +2253,7 @@ func TestCommandSide_RegisterHuman(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,
@@ -2372,6 +2379,7 @@ func TestCommandSide_RegisterHuman(t *testing.T) {
 								false,
 								false,
 								false,
+								false,
 								domain.PasswordlessTypeNotAllowed,
 								"",
 								time.Hour*1,