rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Show why personal OIDC logins are refused

Browse Source 
Personal Google and Microsoft accounts were rejected with a raw
JSON unauthorized response after the OIDC callback. Redirect to a
dedicated auth page that explains the enterprise-account
requirement, and check enterprise eligibility before xms_edov so
Microsoft consumer accounts get the same clear error.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
This commit is contained in:
Bryan Frimin
2026-07-24 21:16:11 +00:00
committed by Cursor Agent
parent b8c3fb086e
commit d1814d7051
5 changed files with 148 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/server/api/connect/v1/oidc_handler.go
View File

@@ -32,6 +32,7 @@ import (
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/iam/oidc"
"go.probo.inc/probo/pkg/mail"
"go.probo.inc/probo/pkg/saferedirect"
"go.probo.inc/probo/pkg/securecookie"
@@ -130,6 +131,13 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) {
identity, continueURL, organizationID, err := h.iam.OIDCService.HandleCallback(ctx, provider, stateParam, code)
if err != nil {
if _, ok := errors.AsType[*oidc.ErrPersonalAccountNotAllowed](err); ok {
h.logger.WarnCtx(ctx, "OIDC login rejected: personal account not allowed")
http.Redirect(w, r, "/auth/personal-account-not-allowed", http.StatusFound)
return
}
h.logger.ErrorCtx(ctx, "cannot handle OIDC callback", log.Error(err))
httpserver.RenderError(w, http.StatusUnauthorized, errors.New("authentication failed"))