hanzoai/flow
2
0
Fork 0
mirror of https://github.com/hanzoai/flow.git synced 2026-10-17 01:29:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

auth: name the identity provider Hanzo IAM, not the vendor it never was

Browse Source 
The IAM seam comments credited Casdoor for behavior that is ours: Hanzo IAM
is original work, and the Casdoor-derived server (iam-v1) is retired and ships
in nothing. "Hanzo IAM is Casdoor-derived" was simply false.

Claim handling is unchanged — org still reads `owner` before `org`/`organization`,
and built-in/admin are still skipped as non-tenants. Only the attribution moves.

Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
zooqueen
2026-07-28 17:11:14 -07:00
co-authored by Hanzo Dev
parent 1ce238f12f
commit 96300836fb
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/backend/base/flow/services/auth/iam.py
+1 -1
View File
@@ -49,7 +49,7 @@ class IAMConfig:
issuer: str
jwks_url: str
audience: str = ""
# Claim names — Hanzo IAM is Casdoor-derived; org falls back to the `owner` claim.
# Claim names — org falls back to the `owner` claim.
org_claim: str = "org"
org_fallback_claim: str = "owner"
project_claim: str = "project"
src/backend/base/flow/services/auth/iam_org.py
+4 -4
View File
@@ -3,7 +3,7 @@ Hanzo IAM Organization extraction for Flow (Flow fork).
Extracts the IAM organization slug from:
1. X-IAM-Org-Id request header (set by gateway)
2. JWT `owner` claim (from Casdoor OIDC token)
2. JWT `owner` claim (from the IAM OIDC token)
3. JWT `org` or `organization` claim (generic OIDC)
Updates the user's org_id in the database on each authenticated request.
@@ -40,10 +40,10 @@ def extract_org_from_request(request: Request) -> str | None:
def extract_org_from_jwt_payload(payload: dict) -> str | None:
"""Extract org slug from a decoded JWT payload.
Casdoor uses the `owner` field. We also check `org` and `organization`
for compatibility with other OIDC providers.
Hanzo IAM carries the org in the `owner` field. We also check `org` and
`organization` for compatibility with other OIDC providers.
Skip the Casdoor built-in org as it's not a real tenant.
Skip the built-in org as it's not a real tenant.
"""
org = (
payload.get("owner")