Skip to content

fix: note regarding: ORY-04-001 WP2 #2101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

fix: note regarding: ORY-04-001 WP2 #2101

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9a48c6e
Added note regarding: ORY-04-001 WP2 and informing
jhickmanit Apr 7, 2025
0ea53bc
Merge branch 'master' into jhickman/saml-domain-validation
jhickmanit Apr 8, 2025
cda45f0
removed note format and formatting fixes.
jhickmanit Apr 8, 2025
d47853b
moved to Organizations block as this impacts both SAML and OIDC. Remo…
jhickmanit Apr 10, 2025
bb73255
Merge branch 'master' into jhickman/saml-domain-validation
jhickmanit Apr 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions docs/kratos/organizations/organizations.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,14 @@ members of an organization must use one of the organization's OIDC SSO connectio
An organization can have multiple domains. Registrations for email addresses with a domain that belongs to an organization must go
through one of the organization's OIDC SSO connections.

Some identity providers do not validate email domain ownership. This can lead to situations where Enterprise SSO with
Organizations is configured for a specified domain such as `@example.com`, but due to this lack of this email domain ownership
validation by the identity provider, a users with other email domains such as `@gmail.com` can still authenticate successfully via
the identity provider.

This will end up with the user being part of the configured organization in your Ory project, even if the domain does not match
any of the configured domains.

```mdx-code-block
<Mermaid
chart={`
Expand Down
Loading