From df2033253dfd8aac82b7c30bd41a6891962d1ec7 Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Thu, 10 Oct 2024 17:29:53 +0200 Subject: [PATCH] fix: only allow domain discovery if no organization was preselected (#8748) # Which Problems Are Solved If an organization was preselected using an orgID or primaryDomain scope, users could still switch to another organization, if the latter allowed domain discovery and the entered username / or login_hint included the corresponding domain suffix. # How the Problems Are Solved Domain discovery will only be done in case no org was preselected. # Additional Changes None # Additional Context - closes https://github.com/zitadel/zitadel/issues/8464 - closes https://github.com/zitadel/zitadel/issues/8588 --- .../repository/eventsourcing/eventstore/auth_request.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request.go b/internal/auth/repository/eventsourcing/eventstore/auth_request.go index 673877ff4..e098350c0 100644 --- a/internal/auth/repository/eventsourcing/eventstore/auth_request.go +++ b/internal/auth/repository/eventsourcing/eventstore/auth_request.go @@ -785,9 +785,12 @@ func (repo *AuthRequestRepo) checkLoginName(ctx context.Context, request *domain } // the user was either not found or not active // so check if the loginname suffix matches a verified org domain - ok, errDomainDiscovery := repo.checkDomainDiscovery(ctx, request, loginNameInput) - if errDomainDiscovery != nil || ok { - return errDomainDiscovery + // but only if no org was requested (by id or domain) + if request.RequestedOrgID == "" { + ok, errDomainDiscovery := repo.checkDomainDiscovery(ctx, request, loginNameInput) + if errDomainDiscovery != nil || ok { + return errDomainDiscovery + } } // let's once again check if the user was just inactive if user != nil && user.State == int32(domain.UserStateInactive) {