Merge commit from fork

mirror of https://github.com/andwati/zitadel.git synced 2026-11-12 17:15:15 +00:00

* fix: block Login V2 auth for users in deactivated organizations

Enforce organization state on session creation, OIDC token issuance/refresh,
and SAML session creation so deactivated org users cannot authenticate.

Co-authored-by: Cursor <[email protected]>

* fix: reject claim serving for users in deactivated organizations

Require an active resource-owner org in OIDC userinfo and SAML attribute
paths, and use distinct error IDs for inactive user vs inactive org at
token issuance.

Co-authored-by: Cursor <[email protected]>

* fix: drop sessions and tokens when an organization is deactivated

Mirror OrgRemoved cleanup for OrgDeactivated in the V2 session projection
and V1 auth user_session, token, and refresh_token handlers. Also delete
V2 sessions on OrgRemoved, which does not emit per-user removal events.

Co-authored-by: Cursor <[email protected]>

* fix: reject API tokens from deactivated organizations

Check the caller's resource-owner org state in authz middleware via a
cached OrgByID lookup, so already-issued tokens lose ZITADEL API access
when their organization is deactivated. Return unauthenticated (401).
Target org remains unrestricted so instance admins can still manage
deactivated orgs.

Co-authored-by: Cursor <[email protected]>

* fix: invalidate OIDC refresh tokens after org deactivation

Reject refresh exchange if the user's organization was deactivated
after the refresh token was issued, so grants stay dead after reactivate.

Co-authored-by: Cursor <[email protected]>

* fix: invalidate V2 access tokens after org deactivation

Treat OrgDeactivated after the token position as session termination in
ActiveAccessTokenByToken, so issued ATs stay dead after reactivation.

Co-authored-by: Cursor <[email protected]>

---------

Co-authored-by: Cursor <[email protected]>

This commit is contained in:

Livio Spring

2026-08-14 06:12:45 +02:00

committed by

GitHub

co-authored by

Cursor

parent a4266fa7fc

commit 260446f91f

52 changed files with 854 additions and 20 deletions

									
										internal/query/userinfo_by_id.sql
									
		+2
		-1
	
												View File
												
				@@ -2,7 +2,8 @@ with usr as (

					select u.id, u.creation_date, u.change_date, u.sequence, u.state, u.resource_owner, u.username, n.login_name as preferred_login_name

					from projections.users14 u

					left join projections.login_names3 n on u.id = n.user_id and u.instance_id = n.instance_id

					where u.id = $1 and u.state = 1 -- only allow active users

					join projections.orgs1 o on o.id = u.resource_owner and o.instance_id = u.instance_id and o.org_state = 1

					where u.id = $1 and u.state = 1 -- only allow active users in active organizations

					and u.instance_id = $2

					and n.is_primary = true

				),