rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Treat OIDC and magic link sessions as password-equivalent when assuming an org

Browse Source 
Users authenticated via Google/Microsoft OIDC or magic link previously
relied on a fall-through in the password-only org check. Make the rule
explicit so SSO-only users can access password-only organizations
without being bounced to the password login form they cannot satisfy.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-04-30 15:08:59 +02:00
committed by Émile Ré
parent 5f087b47b8
commit febf4a930e
1 changed files with 15 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
pkg/iam/session_service.go
View File

@@ -566,14 +566,25 @@ func (s SessionService) AssumeOrganizationSession(
return NewSAMLAuthenticationRequiredError("policy_requirement") return NewSAMLAuthenticationRequiredError("policy_requirement")
} }
case coredata.SAMLEnforcementPolicyOptional: case coredata.SAMLEnforcementPolicyOptional:
// SAML is optional: both PASSWORD and SAML root sessions are allowed. // SAML is optional: any password-equivalent (PASSWORD, OIDC,
// MAGIC_LINK) or SAML root session is allowed.
} }
} else { } else {
switch rootSession.AuthMethod { switch rootSession.AuthMethod {
case coredata.AuthMethodPassword: case coredata.AuthMethodPassword,
coredata.AuthMethodOIDC,
coredata.AuthMethodMagicLink:
// No SAML configuration for this org+domain: any
// password-equivalent root session is allowed. OIDC
// (Google / Microsoft) and magic-link logins are treated
// as password logins because the user has authenticated
// against the platform itself rather than a third-party
// IdP federated with this organization.
case coredata.AuthMethodSAML: case coredata.AuthMethodSAML:
// No (or non-required) SAML configuration: require a password-authenticated or magic-link root session // SAML root sessions are bound to a different organization's
// (eg. when switching into a password-based org from a SAML login) // IdP, so they cannot be used to access an organization that
// does not federate with that IdP. Force re-authentication
// with a password-equivalent method.
return NewPasswordAuthenticationRequiredError("password_authentication_required") return NewPasswordAuthenticationRequiredError("password_authentication_required")
} }
} }