search

fief-dev / fief

Users and authentication management SaaS
https://www.fief.dev
Other
577 stars 48 forks source link

An error should be shown when trying to call /authorize and /api/token with a client from another tenant #102

Closed frankie567 closed 2 years ago

frankie567 commented 2 years ago

Describe the bug

Currently, if you make an OAuth2 process with a _CLIENTID tied to a sub-tenant, you can go through the whole process by calling the root /authorize and /api/token.

It's only at the end of the /api/token call that you'll get a grant_error (because we try to look for a user in the wrong tenant).

To Reproduce

On a workspace with several tenants:

  1. Use a client from a sub-tenant
  2. Make the OAuth2 process using the routes from the main tenant

Expected behavior

An error shall be shown immediately on /authorize to prevent the user to go through the OAuth2 process.

Configuration