Auto-create staff users from Google sign-in on staging - #142
Merged
Merged
Conversation
Temporary interim for staging's dual-org setup (ADR 007). An IdP-verified email on an allow-listed domain may auto-create a user in a listed org whose login policy disallows registration, so new staff sign in with Google instead of a hand-made password user. When that email already owns a user in another org, the user is created under the +staff alias, matching the convention admins applied by hand. Fully off unless both IDP_AUTO_CREATE_EMAIL_DOMAINS and IDP_AUTO_CREATE_ORGS are set, which production never does. Refs #140
Contributor
🧪 Test Summary
|
yahyafakhroji
requested review from
JoseSzycho,
kevwilliams and
mattdjenkinson
September 22, 2026 04:50
yahyafakhroji
enabled auto-merge
September 22, 2026 04:56
mattdjenkinson
approved these changes
Sep 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On staging the staff portal is pinned to a Zitadel org that has registration switched off. A new staff member's first Google sign-in there ends on "sign-up is not available", so an admin creates the user in the Zitadel console by hand, which forces a password. When that person already has a Datum Cloud user for the same Google account the username collides as well, which is where the
+staffaliases come from.Solution
Three env flags, all unset by default and never set in production, open one door in the SSO callback: an IdP-verified email on an allow-listed domain may auto-create a user in a listed org even though registration is off. If the email already owns a user in another org, the user is created under the
+staffalias instead, the same shape admins produced by hand. Password sign-up stays off and the sign-up link stays hidden. ADR 007 records the rationale and the removal steps for when staging moves to a single org.Refs #140