Files
Livio SpringandCursor 260446f91f Merge commit from fork
* fix: block Login V2 auth for users in deactivated organizations

Enforce organization state on session creation, OIDC token issuance/refresh,
and SAML session creation so deactivated org users cannot authenticate.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: reject claim serving for users in deactivated organizations

Require an active resource-owner org in OIDC userinfo and SAML attribute
paths, and use distinct error IDs for inactive user vs inactive org at
token issuance.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: drop sessions and tokens when an organization is deactivated

Mirror OrgRemoved cleanup for OrgDeactivated in the V2 session projection
and V1 auth user_session, token, and refresh_token handlers. Also delete
V2 sessions on OrgRemoved, which does not emit per-user removal events.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: reject API tokens from deactivated organizations

Check the caller's resource-owner org state in authz middleware via a
cached OrgByID lookup, so already-issued tokens lose ZITADEL API access
when their organization is deactivated. Return unauthenticated (401).
Target org remains unrestricted so instance admins can still manage
deactivated orgs.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: invalidate OIDC refresh tokens after org deactivation

Reject refresh exchange if the user's organization was deactivated
after the refresh token was issued, so grants stay dead after reactivate.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: invalidate V2 access tokens after org deactivation

Treat OrgDeactivated after the token position as session termination in
ActiveAccessTokenByToken, so issued ATs stay dead after reactivation.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-14 06:12:45 +02:00
..
2026-06-15 15:36:14 +02:00
2026-03-17 12:54:27 +01:00
2026-03-17 12:54:27 +01:00
2026-03-17 12:54:27 +01:00
2024-11-04 10:44:51 +00:00
2026-07-29 05:46:27 +02:00
2026-08-14 06:11:39 +02:00
2026-03-17 12:54:27 +01:00
2026-08-14 06:12:45 +02:00
2026-06-16 15:19:56 +02:00
2024-09-11 10:53:55 +00:00
2026-06-15 15:36:14 +02:00
2026-06-15 15:27:47 +02:00
2024-04-11 09:16:10 +02:00
2024-01-17 10:16:48 +00:00
2024-01-17 10:16:48 +00:00
2026-08-14 06:12:45 +02:00
2026-08-14 06:12:45 +02:00
2026-08-14 06:12:45 +02:00
2026-08-14 06:12:45 +02:00
2026-08-14 06:12:45 +02:00
2026-08-14 06:11:39 +02:00
2026-07-09 13:28:09 +02:00
2025-07-15 13:38:00 +02:00
2025-07-15 13:38:00 +02:00
2026-08-14 06:12:45 +02:00
2026-08-14 06:12:45 +02:00
2025-10-29 10:07:35 +01:00
2025-10-29 10:07:35 +01:00
2026-06-15 15:36:14 +02:00
2026-06-15 15:36:14 +02:00
2026-06-15 15:36:14 +02:00
2026-06-15 15:36:14 +02:00
2026-08-14 06:12:45 +02:00
2026-08-14 06:12:45 +02:00
2026-03-11 08:25:21 +01:00
2026-07-09 13:28:09 +02:00
2026-07-09 13:28:09 +02:00
2025-10-29 10:07:35 +01:00
2025-10-29 10:07:35 +01:00
2026-08-14 06:11:39 +02:00
2026-06-08 16:41:08 +02:00
2026-06-08 16:41:08 +02:00
2026-06-08 16:41:08 +02:00
2026-06-08 16:41:08 +02:00
2026-08-14 06:11:39 +02:00
2026-08-14 06:11:39 +02:00
2026-06-08 16:41:08 +02:00
2026-06-08 16:41:08 +02:00