[SOLVED] Validate on domain with OAuth login

[bold elbow]

I want to validate an email address on the domain before an account creation. I am using a organization level OAuth from microsoft, but i only want to allow users from paying organizations. I am using the oauth signin option. Can i block the account creation based on the domain? The code to check it i allready have, but cant figure out the moment when to trigger it.

[fair breach]

why not validate before triggering the OAuth client side?

[pallid viper]

Can you put restrictions on the oauth provider side?

[bold elbow]

Uhm, i dont know actually, but i have a table of active organizations in appwrite

So i want to connect that with the active list of organzations.

[bold elbow]

How to do that and force the login email through the oauth?

[bold elbow]

I have something implemented now that i logout immediately after checking the organization but then they already authorized successfully. The user account is created in this case. That is kind of a problem and a security issue

[pallid viper]

This relies on client side logging out which isn't reliable.

Maybe what you can do is set the user limit to 1 and then use a function to validate email before creating an account. Then, do the oauth flow

[bold elbow]

That wont make it easy for the user, because then you will use a magic link for example to login, and then use the oauth login. I could switch entirely to magic link, but there goes the secure oauth method 😅

[pallid viper]

What do you mean magic link? By validating email, I mean only creating the account if they're in whatever organiy

[bold elbow]

I think i dont understand the workflow you propose

[pallid viper]

1. User lands on sign up page
2. User enters email
3. App executes the function passing email
4. Function gets the domain and checks if they paid
5. If yes, function creates account
   1. App calls create oauth2 session
6. If no, return error
   1. App sees error and returns a message saying they need to pay

[bold elbow]

Okay, in this case they can give a dummy email, and login with oauth with their real email, and pass the validation without paying?

[pallid viper]

No because the only way the account can be created is via the function

[bold elbow]

Oh, and what creation function do you recommend

[pallid viper]

What?

[bold elbow]

Well, with the function you should create the account. But you need to set a password or something

[pallid viper]

No you don't need to set a password

https://appwrite.io/docs/references/cloud/server-nodejs/users#create

[bold elbow]

Ah sorry, didnt know about the users endpoint. But users endpoint cab crrate users when limit is on 1?

[pallid viper]

Yes, console account and API keys are not restricted by the limit. The limit is only client side

[bold elbow]

Nice!!!

That sounds helpful

With this we need only 1 account for multiple organizations for 1 user

Thanks!

[SOLVED] Validate on domain with OAuth login