Enter-as session uses target org security provider and optional targetMemberId

Ya

23 Aprili 2026, 23:39 UTC

Mwandishi

Kamo

Ahadi ya

01feb45

Enter-as was setting Redis securityOrgId from the user global security_provider, while login sets it from the target org FQDN chain. That mismatch made cross-domain hand-offs look like the source/provider org. Resolve securityOrgId from the target Organization.securityProvider like login. When the client sends targetMemberId (my-networks row), load that Member by id and verify it belongs to the caller and targetOrgId before creating ***/OTK.