feat: multiple domains (#188)

* check uniqueness on create and register user * change user email, reserve release unique email * usergrant unique aggregate * usergrant uniqueness * validate UserGrant * fix tests * domain is set on username in all orgs * domain in admin * org domain sql * zitadel domain org name * org domains * org iam policy * default org iam policy * SETUP * load login names * login by login name * login name * fix: merge master * fix: merge master * Update internal/user/repository/eventsourcing/user.go Co-authored-by: Livio Amstutz <[email protected]> * fix: fix unique domains * fix: rename env variable Co-authored-by: adlerhurst <[email protected]> Co-authored-by: Livio Amstutz <[email protected]>
2026-11-01 20:02:15 +00:00 · 2020-06-16 11:40:18 +02:00
parent 64b14b4e19
commit 7a6ca24625
109 changed files with 12578 additions and 6025 deletions
@@ -230,6 +230,21 @@ var ManagementService_AuthMethods = utils_auth.MethodMapping{
 		CheckParam: "",
 	},

+	"/caos.zitadel.management.api.v1.ManagementService/SearchMyOrgDomains": utils_auth.Option{
+		Permission: "org.read",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.management.api.v1.ManagementService/AddMyOrgDomain": utils_auth.Option{
+		Permission: "org.write",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.management.api.v1.ManagementService/RemoveMyOrgDomain": utils_auth.Option{
+		Permission: "org.write",
+		CheckParam: "",
+	},
+
 	"/caos.zitadel.management.api.v1.ManagementService/GetOrgMemberRoles": utils_auth.Option{
 		Permission: "org.member.read",
 		CheckParam: "",
@@ -1101,6 +1101,10 @@ func request_ManagementService_GetOrgByID_0(ctx context.Context, marshaler runti

 }

+var (
+	filter_ManagementService_GetOrgByDomainGlobal_0 = &utilities.DoubleArray{Encoding: map[string]int{"domain": 0}, Base: []int{1, 1, 0}, Check: []int{0, 1, 2}}
+)
+
 func request_ManagementService_GetOrgByDomainGlobal_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq OrgDomain
 	var metadata runtime.ServerMetadata
@@ -1123,6 +1127,10 @@ func request_ManagementService_GetOrgByDomainGlobal_0(ctx context.Context, marsh
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "domain", err)
 	}

+	if err := runtime.PopulateQueryParameters(&protoReq, req.URL.Query(), filter_ManagementService_GetOrgByDomainGlobal_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
 	msg, err := client.GetOrgByDomainGlobal(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err

@@ -1198,6 +1206,67 @@ func request_ManagementService_ReactivateOrg_0(ctx context.Context, marshaler ru

 }

+func request_ManagementService_SearchMyOrgDomains_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq OrgDomainSearchRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.SearchMyOrgDomains(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_AddMyOrgDomain_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq AddOrgDomainRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.AddMyOrgDomain(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_RemoveMyOrgDomain_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq RemoveOrgDomainRequest
+	var metadata runtime.ServerMetadata
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["domain"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "domain")
+	}
+
+	protoReq.Domain, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "domain", err)
+	}
+
+	msg, err := client.RemoveMyOrgDomain(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
 func request_ManagementService_GetOrgMemberRoles_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq empty.Empty
 	var metadata runtime.ServerMetadata
@@ -4551,6 +4620,66 @@ func RegisterManagementServiceHandlerClient(ctx context.Context, mux *runtime.Se

 	})

+	mux.Handle("POST", pattern_ManagementService_SearchMyOrgDomains_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_SearchMyOrgDomains_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_SearchMyOrgDomains_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_AddMyOrgDomain_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_AddMyOrgDomain_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_AddMyOrgDomain_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("DELETE", pattern_ManagementService_RemoveMyOrgDomain_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_RemoveMyOrgDomain_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_RemoveMyOrgDomain_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
 	mux.Handle("GET", pattern_ManagementService_GetOrgMemberRoles_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -5907,6 +6036,12 @@ var (

 	pattern_ManagementService_ReactivateOrg_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2}, []string{"orgs", "id", "_reactivate"}, ""))

+	pattern_ManagementService_SearchMyOrgDomains_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"orgs", "me", "domains", "_search"}, ""))
+
+	pattern_ManagementService_AddMyOrgDomain_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"orgs", "me", "domains"}, ""))
+
+	pattern_ManagementService_RemoveMyOrgDomain_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"orgs", "me", "domains", "domain"}, ""))
+
 	pattern_ManagementService_GetOrgMemberRoles_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"orgs", "members", "roles"}, ""))

 	pattern_ManagementService_AddMyOrgMember_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"orgs", "me", "members"}, ""))
@@ -6127,6 +6262,12 @@ var (

 	forward_ManagementService_ReactivateOrg_0 = runtime.ForwardResponseMessage

+	forward_ManagementService_SearchMyOrgDomains_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_AddMyOrgDomain_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_RemoveMyOrgDomain_0 = runtime.ForwardResponseMessage
+
 	forward_ManagementService_GetOrgMemberRoles_0 = runtime.ForwardResponseMessage

 	forward_ManagementService_AddMyOrgMember_0 = runtime.ForwardResponseMessage
@@ -63,6 +63,47 @@
            "in": "path",
            "required": true,
            "type": "string"
+          },
+          {
+            "name": "org_id",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          },
+          {
+            "name": "creation_date",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "format": "date-time"
+          },
+          {
+            "name": "change_date",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "format": "date-time"
+          },
+          {
+            "name": "verified",
+            "in": "query",
+            "required": false,
+            "type": "boolean",
+            "format": "boolean"
+          },
+          {
+            "name": "primary",
+            "in": "query",
+            "required": false,
+            "type": "boolean",
+            "format": "boolean"
+          },
+          {
+            "name": "sequence",
+            "in": "query",
+            "required": false,
+            "type": "string",
+            "format": "uint64"
          }
        ],
        "tags": [
@@ -168,6 +209,82 @@
        ]
      }
    },
+    "/orgs/me/domains": {
+      "post": {
+        "operationId": "AddMyOrgDomain",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1OrgDomain"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1AddOrgDomainRequest"
+            }
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
+    "/orgs/me/domains/_search": {
+      "post": {
+        "operationId": "SearchMyOrgDomains",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1OrgDomainSearchResponse"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1OrgDomainSearchRequest"
+            }
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
+    "/orgs/me/domains/{domain}": {
+      "delete": {
+        "operationId": "RemoveMyOrgDomain",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "domain",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
    "/orgs/me/members": {
      "post": {
        "operationId": "AddMyOrgMember",
@@ -3418,6 +3535,14 @@
      },
      "description": "`Value` represents a dynamically typed value which can be either\nnull, a number, a string, a boolean, a recursive struct value, or a\nlist of values. A producer of value is expected to set one of that\nvariants, absence of any variant indicates an error.\n\nThe JSON representation for `Value` is JSON value."
    },
+    "v1AddOrgDomainRequest": {
+      "type": "object",
+      "properties": {
+        "domain": {
+          "type": "string"
+        }
+      }
+    },
    "v1AddOrgMemberRequest": {
      "type": "object",
      "properties": {
@@ -4062,9 +4187,132 @@
        "name": {
          "type": "string"
        },
+        "sequence": {
+          "type": "string",
+          "format": "uint64"
+        }
+      }
+    },
+    "v1OrgDomain": {
+      "type": "object",
+      "properties": {
+        "org_id": {
+          "type": "string"
+        },
+        "creation_date": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "change_date": {
+          "type": "string",
+          "format": "date-time"
+        },
        "domain": {
          "type": "string"
        },
+        "verified": {
+          "type": "boolean",
+          "format": "boolean"
+        },
+        "primary": {
+          "type": "boolean",
+          "format": "boolean"
+        },
+        "sequence": {
+          "type": "string",
+          "format": "uint64"
+        }
+      }
+    },
+    "v1OrgDomainSearchKey": {
+      "type": "string",
+      "enum": [
+        "ORGDOMAINSEARCHKEY_UNSPECIFIED",
+        "ORGDOMAINSEARCHKEY_DOMAIN"
+      ],
+      "default": "ORGDOMAINSEARCHKEY_UNSPECIFIED"
+    },
+    "v1OrgDomainSearchQuery": {
+      "type": "object",
+      "properties": {
+        "key": {
+          "$ref": "#/definitions/v1OrgDomainSearchKey"
+        },
+        "method": {
+          "$ref": "#/definitions/v1SearchMethod"
+        },
+        "value": {
+          "type": "string"
+        }
+      }
+    },
+    "v1OrgDomainSearchRequest": {
+      "type": "object",
+      "properties": {
+        "offset": {
+          "type": "string",
+          "format": "uint64"
+        },
+        "limit": {
+          "type": "string",
+          "format": "uint64"
+        },
+        "queries": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1OrgDomainSearchQuery"
+          }
+        }
+      }
+    },
+    "v1OrgDomainSearchResponse": {
+      "type": "object",
+      "properties": {
+        "offset": {
+          "type": "string",
+          "format": "uint64"
+        },
+        "limit": {
+          "type": "string",
+          "format": "uint64"
+        },
+        "total_result": {
+          "type": "string",
+          "format": "uint64"
+        },
+        "result": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1OrgDomainView"
+          }
+        }
+      }
+    },
+    "v1OrgDomainView": {
+      "type": "object",
+      "properties": {
+        "org_id": {
+          "type": "string"
+        },
+        "creation_date": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "change_date": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "domain": {
+          "type": "string"
+        },
+        "verified": {
+          "type": "boolean",
+          "format": "boolean"
+        },
+        "primary": {
+          "type": "boolean",
+          "format": "boolean"
+        },
        "sequence": {
          "type": "string",
          "format": "uint64"
@@ -37,6 +37,26 @@ func (m *MockManagementServiceClient) EXPECT() *MockManagementServiceClientMockR
 	return m.recorder
 }

+// AddMyOrgDomain mocks base method
+func (m *MockManagementServiceClient) AddMyOrgDomain(arg0 context.Context, arg1 *grpc.AddOrgDomainRequest, arg2 ...grpc0.CallOption) (*grpc.OrgDomain, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "AddMyOrgDomain", varargs...)
+	ret0, _ := ret[0].(*grpc.OrgDomain)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AddMyOrgDomain indicates an expected call of AddMyOrgDomain
+func (mr *MockManagementServiceClientMockRecorder) AddMyOrgDomain(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AddMyOrgDomain", reflect.TypeOf((*MockManagementServiceClient)(nil).AddMyOrgDomain), varargs...)
+}
+
 // AddMyOrgMember mocks base method
 func (m *MockManagementServiceClient) AddMyOrgMember(arg0 context.Context, arg1 *grpc.AddOrgMemberRequest, arg2 ...grpc0.CallOption) (*grpc.OrgMember, error) {
 	m.ctrl.T.Helper()
@@ -1437,6 +1457,26 @@ func (mr *MockManagementServiceClientMockRecorder) RemoveApplication(arg0, arg1
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveApplication", reflect.TypeOf((*MockManagementServiceClient)(nil).RemoveApplication), varargs...)
 }

+// RemoveMyOrgDomain mocks base method
+func (m *MockManagementServiceClient) RemoveMyOrgDomain(arg0 context.Context, arg1 *grpc.RemoveOrgDomainRequest, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "RemoveMyOrgDomain", varargs...)
+	ret0, _ := ret[0].(*emptypb.Empty)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RemoveMyOrgDomain indicates an expected call of RemoveMyOrgDomain
+func (mr *MockManagementServiceClientMockRecorder) RemoveMyOrgDomain(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveMyOrgDomain", reflect.TypeOf((*MockManagementServiceClient)(nil).RemoveMyOrgDomain), varargs...)
+}
+
 // RemoveMyOrgMember mocks base method
 func (m *MockManagementServiceClient) RemoveMyOrgMember(arg0 context.Context, arg1 *grpc.RemoveOrgMemberRequest, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
 	m.ctrl.T.Helper()
@@ -1657,6 +1697,26 @@ func (mr *MockManagementServiceClientMockRecorder) SearchGrantedProjects(arg0, a
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SearchGrantedProjects", reflect.TypeOf((*MockManagementServiceClient)(nil).SearchGrantedProjects), varargs...)
 }

+// SearchMyOrgDomains mocks base method
+func (m *MockManagementServiceClient) SearchMyOrgDomains(arg0 context.Context, arg1 *grpc.OrgDomainSearchRequest, arg2 ...grpc0.CallOption) (*grpc.OrgDomainSearchResponse, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "SearchMyOrgDomains", varargs...)
+	ret0, _ := ret[0].(*grpc.OrgDomainSearchResponse)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// SearchMyOrgDomains indicates an expected call of SearchMyOrgDomains
+func (mr *MockManagementServiceClientMockRecorder) SearchMyOrgDomains(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SearchMyOrgDomains", reflect.TypeOf((*MockManagementServiceClient)(nil).SearchMyOrgDomains), varargs...)
+}
+
 // SearchMyOrgMembers mocks base method
 func (m *MockManagementServiceClient) SearchMyOrgMembers(arg0 context.Context, arg1 *grpc.OrgMemberSearchRequest, arg2 ...grpc0.CallOption) (*grpc.OrgMemberSearchResponse, error) {
 	m.ctrl.T.Helper()
@@ -2,6 +2,7 @@ package grpc

 import (
 	"context"
+	"github.com/golang/protobuf/ptypes/empty"
 )

 func (s *Server) GetOrgByID(ctx context.Context, orgID *OrgID) (*Org, error) {
@@ -17,7 +18,7 @@ func (s *Server) GetOrgByDomainGlobal(ctx context.Context, in *OrgDomain) (*Org,
 	if err != nil {
 		return nil, err
 	}
-	return orgFromView(org), nil
+	return orgFromModel(org), nil
 }

 func (s *Server) DeactivateOrg(ctx context.Context, in *OrgID) (*Org, error) {
@@ -36,6 +37,27 @@ func (s *Server) ReactivateOrg(ctx context.Context, in *OrgID) (*Org, error) {
 	return orgFromModel(org), nil
 }

+func (s *Server) SearchMyOrgDomains(ctx context.Context, in *OrgDomainSearchRequest) (*OrgDomainSearchResponse, error) {
+	domains, err := s.org.SearchMyOrgDomains(ctx, orgDomainSearchRequestToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return orgDomainSearchResponseFromModel(domains), nil
+}
+
+func (s *Server) AddMyOrgDomain(ctx context.Context, in *AddOrgDomainRequest) (*OrgDomain, error) {
+	domain, err := s.org.AddMyOrgDomain(ctx, addOrgDomainToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return orgDomainFromModel(domain), nil
+}
+
+func (s *Server) RemoveMyOrgDomain(ctx context.Context, in *RemoveOrgDomainRequest) (*empty.Empty, error) {
+	err := s.org.RemoveMyOrgDomain(ctx, in.Domain)
+	return &empty.Empty{}, err
+}
+
 func (s *Server) OrgChanges(ctx context.Context, changesRequest *ChangeRequest) (*Changes, error) {
 	response, err := s.org.OrgChanges(ctx, changesRequest.Id, 0, 0)
 	if err != nil {
@@ -26,7 +26,6 @@ func orgFromModel(org *org_model.Org) *Org {
 	logging.Log("GRPC-dVnoj").OnError(err).Debug("unable to get timestamp from time")

 	return &Org{
-		Domain:       org.Domain,
 		ChangeDate:   changeDate,
 		CreationDate: creationDate,
 		Id:           org.AggregateID,
@@ -43,7 +42,6 @@ func orgFromView(org *org_model.OrgView) *Org {
 	logging.Log("GRPC-dVnoj").OnError(err).Debug("unable to get timestamp from time")

 	return &Org{
-		Domain:       org.Domain,
 		ChangeDate:   changeDate,
 		CreationDate: creationDate,
 		Id:           org.ID,
@@ -63,6 +61,97 @@ func orgStateFromModel(state org_model.OrgState) OrgState {
 	}
 }

+func addOrgDomainToModel(domain *AddOrgDomainRequest) *org_model.OrgDomain {
+	return &org_model.OrgDomain{Domain: domain.Domain}
+}
+
+func orgDomainFromModel(domain *org_model.OrgDomain) *OrgDomain {
+	creationDate, err := ptypes.TimestampProto(domain.CreationDate)
+	logging.Log("GRPC-u8Ksj").OnError(err).Debug("unable to get timestamp from time")
+
+	changeDate, err := ptypes.TimestampProto(domain.ChangeDate)
+	logging.Log("GRPC-9osFS").OnError(err).Debug("unable to get timestamp from time")
+
+	return &OrgDomain{
+		ChangeDate:   changeDate,
+		CreationDate: creationDate,
+		OrgId:        domain.AggregateID,
+		Domain:       domain.Domain,
+		Verified:     domain.Verified,
+		Primary:      domain.Primary,
+	}
+}
+
+func orgDomainViewFromModel(domain *org_model.OrgDomainView) *OrgDomainView {
+	creationDate, err := ptypes.TimestampProto(domain.CreationDate)
+	logging.Log("GRPC-7sjDs").OnError(err).Debug("unable to get timestamp from time")
+
+	changeDate, err := ptypes.TimestampProto(domain.ChangeDate)
+	logging.Log("GRPC-8iSji").OnError(err).Debug("unable to get timestamp from time")
+
+	return &OrgDomainView{
+		ChangeDate:   changeDate,
+		CreationDate: creationDate,
+		OrgId:        domain.OrgID,
+		Domain:       domain.Domain,
+		Verified:     domain.Verified,
+		Primary:      domain.Primary,
+	}
+}
+
+func orgDomainSearchRequestToModel(request *OrgDomainSearchRequest) *org_model.OrgDomainSearchRequest {
+	return &org_model.OrgDomainSearchRequest{
+		Limit:   request.Limit,
+		Offset:  request.Offset,
+		Queries: orgDomainSearchQueriesToModel(request.Queries),
+	}
+}
+
+func orgDomainSearchQueriesToModel(queries []*OrgDomainSearchQuery) []*org_model.OrgDomainSearchQuery {
+	modelQueries := make([]*org_model.OrgDomainSearchQuery, len(queries))
+
+	for i, query := range queries {
+		modelQueries[i] = orgDomainSearchQueryToModel(query)
+	}
+
+	return modelQueries
+}
+
+func orgDomainSearchQueryToModel(query *OrgDomainSearchQuery) *org_model.OrgDomainSearchQuery {
+	return &org_model.OrgDomainSearchQuery{
+		Key:    orgDomainSearchKeyToModel(query.Key),
+		Method: searchMethodToModel(query.Method),
+		Value:  query.Value,
+	}
+}
+
+func orgDomainSearchKeyToModel(key OrgDomainSearchKey) org_model.OrgDomainSearchKey {
+	switch key {
+	case OrgDomainSearchKey_ORGDOMAINSEARCHKEY_DOMAIN:
+		return org_model.ORGDOMAINSEARCHKEY_DOMAIN
+	default:
+		return org_model.ORGDOMAINSEARCHKEY_UNSPECIFIED
+	}
+}
+
+func orgDomainSearchResponseFromModel(resp *org_model.OrgDomainSearchResponse) *OrgDomainSearchResponse {
+	return &OrgDomainSearchResponse{
+		Limit:       resp.Limit,
+		Offset:      resp.Offset,
+		TotalResult: resp.TotalResult,
+		Result:      orgDomainsFromModel(resp.Result),
+	}
+}
+func orgDomainsFromModel(viewDomains []*org_model.OrgDomainView) []*OrgDomainView {
+	domains := make([]*OrgDomainView, len(viewDomains))
+
+	for i, domain := range viewDomains {
+		domains[i] = orgDomainViewFromModel(domain)
+	}
+
+	return domains
+}
+
 func orgChangesToResponse(response *org_model.OrgChanges, offset uint64, limit uint64) (_ *Changes) {
 	return &Changes{
 		Limit:   limit,
@@ -516,6 +516,39 @@ service ManagementService {
        };
    }

+
+    rpc SearchMyOrgDomains(OrgDomainSearchRequest) returns (OrgDomainSearchResponse) {
+        option (google.api.http) = {
+            post: "/orgs/me/domains/_search"
+            body: "*"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "org.read"
+        };
+    }
+
+    rpc AddMyOrgDomain(AddOrgDomainRequest) returns (OrgDomain) {
+        option (google.api.http) = {
+            post: "/orgs/me/domains"
+            body: "*"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "org.write"
+        };
+    }
+
+    rpc RemoveMyOrgDomain(RemoveOrgDomainRequest) returns (google.protobuf.Empty) {
+        option (google.api.http) = {
+            delete: "/orgs/me/domains/{domain}"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "org.write"
+        };
+    }
+
    //ORG_MEMBERS
    rpc GetOrgMemberRoles(google.protobuf.Empty) returns (OrgMemberRoles) {
        option (google.api.http) = {
@@ -1637,18 +1670,13 @@ message OrgID {
    string id = 1;
 }

-message OrgDomain {
-    string domain = 1;
-}
-
 message Org {
    string id = 1;
    OrgState state = 2;
    google.protobuf.Timestamp creation_date = 3;
    google.protobuf.Timestamp change_date = 4;
    string name = 5;
-    string domain = 6;
-    uint64 sequence = 7;
+    uint64 sequence = 6;
 }

 enum OrgState {
@@ -1657,6 +1685,62 @@ enum OrgState {
    ORGSTATE_INACTIVE = 2;
 }

+message OrgDomains {
+    repeated OrgDomain domains = 1;
+}
+
+message OrgDomain {
+    string org_id = 1;
+    google.protobuf.Timestamp creation_date = 2;
+    google.protobuf.Timestamp change_date = 3;
+    string domain = 4;
+    bool verified = 5;
+    bool primary = 6;
+    uint64 sequence = 7;
+}
+
+message OrgDomainView {
+    string org_id = 1;
+    google.protobuf.Timestamp creation_date = 2;
+    google.protobuf.Timestamp change_date = 3;
+    string domain = 4;
+    bool verified = 5;
+    bool primary = 6;
+    uint64 sequence = 7;
+}
+
+message AddOrgDomainRequest {
+    string domain = 1 [(validate.rules).string = {min_len: 1, max_len: 200}];
+}
+
+message RemoveOrgDomainRequest {
+    string domain = 1 [(validate.rules).string = {min_len: 1, max_len: 200}];
+}
+
+message OrgDomainSearchResponse {
+    uint64 offset = 1;
+    uint64 limit = 2;
+    uint64 total_result = 3;
+    repeated OrgDomainView result = 4;
+}
+
+message OrgDomainSearchRequest {
+    uint64 offset = 1;
+    uint64 limit = 2;
+    repeated OrgDomainSearchQuery queries = 3;
+}
+
+message OrgDomainSearchQuery {
+    OrgDomainSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}];
+    SearchMethod method = 2;
+    string value = 3;
+}
+
+enum OrgDomainSearchKey {
+    ORGDOMAINSEARCHKEY_UNSPECIFIED = 0;
+    ORGDOMAINSEARCHKEY_DOMAIN = 1;
+}
+
 message OrgMemberRoles {
    repeated string roles = 1;
 }