From 1beabed8cf682cf39caf77c4b28d460927c54b84 Mon Sep 17 00:00:00 2001
From: Max Peintner <max@caos.ch>
Date: Fri, 3 Jul 2026 16:25:20 +0200
Subject: [PATCH] fix(login): preserve org domain suffix through account
 chooser navigation (#12304)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #12024

# Which Problems Are Solved

When the login flow is started with an
`urn:zitadel:iam:org:domain:primary:{domain}` scope, the resolved domain
suffix is lost if the user navigates through the account chooser (e.g.
clicking "Use another account"). This causes the login to fail with
"User not found" because the organization can no longer be resolved.

Additionally, the `hideLoginNameSuffix` branding setting was never
respected by the login app.

# How the Problems Are Solved

- Forward the `orgDomain` parameter through `gotoAccounts()` and the
`/accounts` page, so it survives navigation to `/loginname` — the same
way `organization` and `requestId` are already forwarded.
- Respect `BrandingSettings.hideLoginNameSuffix`: when enabled, the
`@domain.com` suffix is hidden from the input UI but still used
internally for user search.

---------

Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com>
---
 apps/login/src/app/(login)/accounts/page.tsx  |  5 +++
 apps/login/src/app/(login)/loginname/page.tsx |  5 ++-
 apps/login/src/components/username-form.tsx   |  4 +-
 apps/login/src/lib/server/flow-initiation.ts  | 42 ++++++++++++-------
 4 files changed, 37 insertions(+), 19 deletions(-)

diff --git a/apps/login/src/app/(login)/accounts/page.tsx b/apps/login/src/app/(login)/accounts/page.tsx
index edae804e0..475e8e5bd 100644
--- a/apps/login/src/app/(login)/accounts/page.tsx
+++ b/apps/login/src/app/(login)/accounts/page.tsx
@@ -43,6 +43,7 @@ export default async function Page(props: { searchParams: Promise<Record<string
 
   const requestId = searchParams?.requestId;
   const organization = searchParams?.organization;
+  const orgDomain = searchParams?.orgDomain;
 
   const _headers = await headers();
   const { serviceConfig } = getServiceConfig(_headers);
@@ -69,6 +70,10 @@ export default async function Page(props: { searchParams: Promise<Record<string
     params.append("organization", organization);
   }
 
+  if (orgDomain) {
+    params.append("orgDomain", orgDomain);
+  }
+
   return (
     <DynamicTheme branding={branding}>
       <div className="flex flex-col space-y-4">
diff --git a/apps/login/src/app/(login)/loginname/page.tsx b/apps/login/src/app/(login)/loginname/page.tsx
index a656d0860..1cf4960a2 100644
--- a/apps/login/src/app/(login)/loginname/page.tsx
+++ b/apps/login/src/app/(login)/loginname/page.tsx
@@ -20,7 +20,7 @@ export default async function Page(props: { searchParams: Promise<Record<string
   const loginName = searchParams?.loginName;
   const requestId = searchParams?.requestId;
   const organization = searchParams?.organization;
-  const suffix = searchParams?.suffix;
+  const orgDomain = searchParams?.orgDomain;
   const submit: boolean = searchParams?.submit === "true";
 
   const _headers = await headers();
@@ -64,7 +64,8 @@ export default async function Page(props: { searchParams: Promise<Record<string
             organization={organization} // stick to "organization" as we still want to do user discovery based on the searchParams not the default organization, later the organization is determined by the found user
             defaultOrganization={defaultOrganization}
             loginSettings={loginSettings}
-            suffix={suffix}
+            suffix={orgDomain}
+            hideSuffix={branding?.hideLoginNameSuffix}
             submit={submit}
             allowRegister={!!loginSettings?.allowRegister}
           ></UsernameForm>
diff --git a/apps/login/src/components/username-form.tsx b/apps/login/src/components/username-form.tsx
index e2adbda15..f73aa3342 100644
--- a/apps/login/src/components/username-form.tsx
+++ b/apps/login/src/components/username-form.tsx
@@ -26,6 +26,7 @@ type Props = {
   organization?: string;
   defaultOrganization?: string;
   suffix?: string;
+  hideSuffix?: boolean;
   submit: boolean;
   allowRegister: boolean;
 };
@@ -36,6 +37,7 @@ export function UsernameForm({
   organization,
   defaultOrganization,
   suffix,
+  hideSuffix,
   loginSettings,
   submit,
   allowRegister,
@@ -111,7 +113,7 @@ export function UsernameForm({
             {...register("loginName", { required: t("required.loginName") })}
             label={inputLabel}
             data-testid="username-text-input"
-            suffix={suffix}
+            suffix={hideSuffix ? undefined : suffix}
           />
           {allowRegister && (
             <button
diff --git a/apps/login/src/lib/server/flow-initiation.ts b/apps/login/src/lib/server/flow-initiation.ts
index 70f46892d..b55f1881c 100644
--- a/apps/login/src/lib/server/flow-initiation.ts
+++ b/apps/login/src/lib/server/flow-initiation.ts
@@ -57,10 +57,12 @@ const gotoAccounts = ({
   request,
   requestId,
   organization,
+  orgDomain,
 }: {
   request: NextRequest;
   requestId: string;
   organization?: string;
+  orgDomain?: string;
 }): NextResponse<unknown> => {
   const accountsUrl = constructUrl(request, "/accounts");
 
@@ -70,6 +72,9 @@ const gotoAccounts = ({
   if (organization) {
     accountsUrl.searchParams.set("organization", organization);
   }
+  if (orgDomain) {
+    accountsUrl.searchParams.set("orgDomain", orgDomain);
+  }
 
   return NextResponse.redirect(accountsUrl);
 };
@@ -79,13 +84,13 @@ const gotoLoginname = ({
   requestId,
   loginHint,
   organization,
-  suffix,
+  orgDomain,
 }: {
   request: NextRequest;
   requestId: string;
   loginHint?: string;
   organization?: string;
-  suffix?: string;
+  orgDomain?: string;
 }): NextResponse<unknown> => {
   const loginNameUrl = constructUrl(request, "/loginname");
   loginNameUrl.searchParams.set("requestId", requestId);
@@ -97,8 +102,8 @@ const gotoLoginname = ({
   if (organization) {
     loginNameUrl.searchParams.set("organization", organization);
   }
-  if (suffix) {
-    loginNameUrl.searchParams.set("suffix", suffix);
+  if (orgDomain) {
+    loginNameUrl.searchParams.set("orgDomain", orgDomain);
   }
 
   return NextResponse.redirect(loginNameUrl);
@@ -140,7 +145,7 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
   }
 
   let organization = "";
-  let suffix = "";
+  let orgDomain = "";
   let idpId = "";
 
   if (authRequest?.scope) {
@@ -155,15 +160,15 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
 
       if (orgDomainScope) {
         const matched = ORG_DOMAIN_SCOPE_REGEX.exec(orgDomainScope);
-        const orgDomain = matched?.[1] ?? "";
+        const scopeDomain = matched?.[1] ?? "";
 
-        logger.info("Extracted org domain:", { orgDomain });
-        if (orgDomain) {
-          const orgs = await getOrgsByDomain({ serviceConfig, domain: orgDomain });
+        logger.info("Extracted org domain:", { orgDomain: scopeDomain });
+        if (scopeDomain) {
+          const orgs = await getOrgsByDomain({ serviceConfig, domain: scopeDomain });
 
           if (orgs.result && orgs.result.length === 1) {
             organization = orgs.result[0].id ?? "";
-            suffix = orgDomain;
+            orgDomain = scopeDomain;
           }
         }
       }
@@ -275,13 +280,14 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
           requestId,
           loginHint: authRequest.loginHint,
           organization,
-          suffix,
+          orgDomain,
         });
       }
       return gotoAccounts({
         request,
         requestId,
         organization,
+        orgDomain,
       });
     } else if (authRequest.prompt.includes(Prompt.LOGIN)) {
       if (authRequest.loginHint) {
@@ -315,8 +321,8 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
       if (organization) {
         loginNameUrl.searchParams.set("organization", organization);
       }
-      if (suffix) {
-        loginNameUrl.searchParams.set("suffix", suffix);
+      if (orgDomain) {
+        loginNameUrl.searchParams.set("orgDomain", orgDomain);
       }
       return NextResponse.redirect(loginNameUrl);
     } else if (authRequest.prompt.includes(Prompt.NONE)) {
@@ -378,13 +384,14 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
             requestId,
             loginHint: authRequest.loginHint,
             organization,
-            suffix,
+            orgDomain,
           });
         }
         return gotoAccounts({
           request,
           requestId,
           organization,
+          orgDomain,
         });
       }
 
@@ -395,6 +402,7 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
           request,
           requestId,
           organization,
+          orgDomain,
         });
       }
 
@@ -425,6 +433,7 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
           return gotoAccounts({
             request,
             organization,
+            orgDomain,
             requestId,
           });
         }
@@ -434,6 +443,7 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
           request,
           requestId,
           organization,
+          orgDomain,
         });
       }
     }
@@ -450,8 +460,8 @@ export async function handleOIDCFlowInitiation(params: FlowInitiationParams): Pr
       loginNameUrl.searchParams.set("organization", organization);
     }
 
-    if (suffix) {
-      loginNameUrl.searchParams.set("suffix", suffix);
+    if (orgDomain) {
+      loginNameUrl.searchParams.set("orgDomain", orgDomain);
     }
 
     return NextResponse.redirect(loginNameUrl);