Return not found for OIDC org access errors

Map membership, profile, and inactive-user failures from
OpenOIDCChildSessionForOrganization to a generic 404 instead
of 500 so org-scoped OIDC callbacks do not reveal tenant
access details.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/connect/v1/oidc_handler.go

@@ -171,6 +171,24 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) {
 	if organizationID != nil {
 		_, _, err = h.iam.SessionService.OpenOIDCChildSessionForOrganization(ctx, rootSession.ID, *organizationID)
 		if err != nil {
+			if _, ok := errors.AsType[*iam.ErrMembershipNotFound](err); ok {
+				httpserver.RenderError(w, http.StatusNotFound, errors.New("not found"))
+
+				return
+			}
+
+			if _, ok := errors.AsType[*iam.ErrProfileNotFound](err); ok {
+				httpserver.RenderError(w, http.StatusNotFound, errors.New("not found"))
+
+				return
+			}
+
+			if _, ok := errors.AsType[*iam.ErrUserInactive](err); ok {
+				httpserver.RenderError(w, http.StatusNotFound, errors.New("not found"))
+
+				return
+			}
+
 			h.logger.ErrorCtx(ctx, "cannot open OIDC child session", log.Error(err))
 			httpserver.RenderError(w, http.StatusInternalServerError, errors.New("internal server error"))