From 6daf44a34a6677d0c5d75caa46c9533ce2a87c6e Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Tue, 11 Oct 2022 11:12:07 +0200 Subject: [PATCH] fix: clear potentially existing user information on auth request for domain discovery (#4528) --- .../auth/repository/eventsourcing/eventstore/auth_request.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request.go b/internal/auth/repository/eventsourcing/eventstore/auth_request.go index 63f923061..30e0cb05a 100644 --- a/internal/auth/repository/eventsourcing/eventstore/auth_request.go +++ b/internal/auth/repository/eventsourcing/eventstore/auth_request.go @@ -712,9 +712,11 @@ func (repo *AuthRequestRepo) checkDomainDiscovery(ctx context.Context, request * return false } // discovery was allowed, so set the org as requested org + // and clear all potentially existing user information and only set the loginname as hint (for registration) request.SetOrgInformation(org.ID, org.Name, org.Domain, false) + request.SetUserInfo("", "", "", "", "", org.ID) request.LoginHint = loginName - request.Prompt = append(request.Prompt, domain.PromptCreate) + request.Prompt = append(request.Prompt, domain.PromptCreate) // to trigger registration return true }