mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-22 23:42:16 +00:00
260446f91f
* fix: block Login V2 auth for users in deactivated organizations Enforce organization state on session creation, OIDC token issuance/refresh, and SAML session creation so deactivated org users cannot authenticate. Co-authored-by: Cursor <[email protected]> * fix: reject claim serving for users in deactivated organizations Require an active resource-owner org in OIDC userinfo and SAML attribute paths, and use distinct error IDs for inactive user vs inactive org at token issuance. Co-authored-by: Cursor <[email protected]> * fix: drop sessions and tokens when an organization is deactivated Mirror OrgRemoved cleanup for OrgDeactivated in the V2 session projection and V1 auth user_session, token, and refresh_token handlers. Also delete V2 sessions on OrgRemoved, which does not emit per-user removal events. Co-authored-by: Cursor <[email protected]> * fix: reject API tokens from deactivated organizations Check the caller's resource-owner org state in authz middleware via a cached OrgByID lookup, so already-issued tokens lose ZITADEL API access when their organization is deactivated. Return unauthenticated (401). Target org remains unrestricted so instance admins can still manage deactivated orgs. Co-authored-by: Cursor <[email protected]> * fix: invalidate OIDC refresh tokens after org deactivation Reject refresh exchange if the user's organization was deactivated after the refresh token was issued, so grants stay dead after reactivate. Co-authored-by: Cursor <[email protected]> * fix: invalidate V2 access tokens after org deactivation Treat OrgDeactivated after the token position as session termination in ActiveAccessTokenByToken, so issued ATs stay dead after reactivation. Co-authored-by: Cursor <[email protected]> --------- Co-authored-by: Cursor <[email protected]>
54 lines
923 B
Go
54 lines
923 B
Go
package domain
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/zitadel/zitadel/internal/eventstore/v1/models"
|
|
)
|
|
|
|
type Org struct {
|
|
models.ObjectRoot
|
|
|
|
State OrgState
|
|
Name string
|
|
|
|
PrimaryDomain string
|
|
Domains []*OrgDomain
|
|
}
|
|
|
|
func (o *Org) IsValid() bool {
|
|
if o == nil {
|
|
return false
|
|
}
|
|
o.Name = strings.TrimSpace(o.Name)
|
|
return o.Name != ""
|
|
}
|
|
|
|
func (o *Org) AddIAMDomain(iamDomain string) {
|
|
orgDomain, _ := NewIAMDomainName(o.Name, iamDomain)
|
|
o.Domains = append(o.Domains, &OrgDomain{Domain: orgDomain, Verified: true, Primary: true})
|
|
}
|
|
|
|
type OrgState int32
|
|
|
|
const (
|
|
OrgStateUnspecified OrgState = iota
|
|
OrgStateActive
|
|
OrgStateInactive
|
|
OrgStateRemoved
|
|
|
|
orgStateMax
|
|
)
|
|
|
|
func (s OrgState) Valid() bool {
|
|
return s > OrgStateUnspecified && s < orgStateMax
|
|
}
|
|
|
|
func (s OrgState) Exists() bool {
|
|
return s != OrgStateRemoved && s != OrgStateUnspecified
|
|
}
|
|
|
|
func (s OrgState) IsActive() bool {
|
|
return s == OrgStateActive
|
|
}
|