fix: Keep the org scope on the Linked accounts page and at sign-in - #141
Merged
Merged
Conversation
yahyafakhroji
force-pushed
the
feat/sso-org-param
branch
from
September 15, 2026 12:23
6ba94c8 to
e54d16e
Compare
Contributor
🧪 Test Summary
|
yahyafakhroji
changed the title
yahyafakhroji
changed the title
yahyafakhroji
requested review from
gaghan430,
kevwilliams and
mattdjenkinson
September 15, 2026 12:30
yahyafakhroji
enabled auto-merge
September 15, 2026 12:30
Contributor
🧪 Test Summary
|
An org-pinned auth request that met a dead or cross-org cookie session self-healed to /login without the organization, so the staff portal landed on the default org's login page after its own logout. Zitadel also rejects a cross-org session with the same FAILED_PRECONDITION code as a stale grant, which pruned a valid session; the org is now checked before the callback and the session is left intact. Refs #140
yahyafakhroji
changed the title
Contributor
🧪 Test Summary
|
mattdjenkinson
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Users signed in under a non-default Zitadel organization (for example staff users from the Datum Technology org) hit two dead ends. The Linked accounts page listed the default Datum Cloud org's providers and linked against them, so the staff portal still saw an unlinked account. And after the staff portal's own sign-out, the next sign-in self-healed to a login page that had dropped the organization, showing the default org's providers for a request Zitadel would only ever finalize on the staff org.
Solution
Resolve the organization from the URL, then the organization the session was signed in under, then the default-org fallback, and use it both for listing providers and for starting a link. At sign-in, keep the org scope on the self-heal redirect, and turn a session from another organization away before the callback instead of discarding it as stale.
Refs #140