fix(auth-ui): resolve org first with default-org fallback (login shows org IdPs)

Datum's OIDC requests don't carry the org-id scope, and the rebuild resolved the login org only from that scope -> org came back undefined -> makeReqCtx(undefined) -> INSTANCE/default context -> /login rendered the instance duplicate IdPs instead of the Datum Cloud org IdPs (which hold the user<->idp links).

Restore the old app's fallback: resolveOrg = urlOrg ?? ZITADEL_DEFAULT_ORG_ID ?? cached getDefaultOrg() (instance Default Organization = Datum Cloud); instance/default only as last resort. Threaded at the login loader and the /authorize decision (propagates organization into downstream ceremony redirects). New getDefaultOrg provider capability (+ fake); optional ZITADEL_DEFAULT_ORG_ID env pin.

Author: yahyafakhroji

app/modules/auth/auth-provider.ts

@@ -117,6 +117,13 @@ export interface AuthProvider {
   getPasswordComplexity(orgId?: string): Promise<PasswordComplexity | undefined>;
   getActiveIdPs(orgId?: string): Promise<IdProvider[]>; // P4
   // getLegalSupport removed — it had zero callers (dead port method).
+  /**
+   * The instance Default Organization id, or null when the provider exposes no default. Used by the
+   * org-first / default-org fallback (`resolveOrg`) so a login without an explicit org still lands
+   * on the real instance org's IdPs/branding instead of the INSTANCE/default context. The result is
+   * stable for the life of the instance, so callers memoize it.
+   */
+  getDefaultOrg(): Promise<string | null>;
 
   // users
   findUser(identifier: string, orgId?: string): Promise<User | null>;

app/modules/auth/providers/fake/fake-provider.ts

@@ -71,6 +71,12 @@ interface Seed {
   idpIntents?: Record<string, IdpIntentResult>; // P4: pre-seeded intent results keyed by intentId
   settingsByOrg?: Record<string, Partial<LoginSettings>>; // P5: per-org setting overrides (e.g. forceMfa)
   orgDomains?: Record<string, string>; // P2 domain discovery: email domain → orgId
+  /**
+   * Instance Default Organization id returned by getDefaultOrg (the org-first / default-org
+   * fallback). Defaults to a stable fake id ('org-default-fake'); seed `null` to exercise the
+   * "no default org → INSTANCE/default context" last-resort branch.
+   */
+  defaultOrgId?: string | null;
 
   deviceAuths?: DeviceAuthSeed[]; // P6: device authorization requests keyed by userCode
   samlRequests?: SamlRequestSeed[]; // P6: SAML auth requests
@@ -104,6 +110,7 @@ export class FakeAuthProvider implements AuthProvider {
   private idpLinks = new Map<string, IdpLink[]>(); // P4: userId → links
   private settingsByOrg: Record<string, Partial<LoginSettings>>; // P5: per-org overrides
   private orgDomains: Record<string, string>; // P2 domain discovery: email domain → orgId
+  private defaultOrgId: string | null; // instance Default Organization (org-first fallback)
   private enrolled = new Map<string, Set<AuthMethod>>(); // P5: dynamically enrolled methods (merged with seeded authMethods)
   private mfaSkippedAt = new Map<string, string>(); // P5: userId → ISO timestamp of last skip
   private issuedOtpEmailCodes = new Map<string, string>(); // sessionId → returnCode issued for that session
@@ -139,6 +146,8 @@ export class FakeAuthProvider implements AuthProvider {
     this.idpIntents = seed.idpIntents ?? {}; // P4
     this.settingsByOrg = seed.settingsByOrg ?? {}; // P5
     this.orgDomains = seed.orgDomains ?? {}; // P2 domain discovery
+    // Stable fake default org unless the seed pins one (or `null` for the no-default branch).
+    this.defaultOrgId = seed.defaultOrgId !== undefined ? seed.defaultOrgId : 'org-default-fake';
     this.deviceAuthSeeds = seed.deviceAuths ?? []; // P6
     this.samlRequestSeeds = seed.samlRequests ?? []; // P6
     this.ldapUserSeeds = seed.ldapUsers ?? []; // P6
@@ -192,6 +201,10 @@ export class FakeAuthProvider implements AuthProvider {
     return this.idps;
   }
 
+  async getDefaultOrg(): Promise<string | null> {
+    return this.defaultOrgId;
+  }
+
   // ─── users ────────────────────────────────────────────────────────────────────
 
   async findUser(identifier: string, _orgId?: string): Promise<User | null> {
@@ -631,6 +644,10 @@ export class FakeAuthProvider implements AuthProvider {
   setLoginDefaultRedirectUri(uri: string | undefined): void {
     this.loginDefaultRedirectUri = uri;
   }
+  // Override the instance Default Organization getDefaultOrg returns (null ⇒ no default org).
+  setDefaultOrg(id: string | null): void {
+    this.defaultOrgId = id;
+  }
   // P2 domain discovery: flip the BASE allowDomainDiscovery flag (getLoginSettings(undefined)).
   // Mirrors setLoginDefaultRedirectUri — a deterministic seam for the resolveIdentifier ON test,
   // since the instance/base policy (not a per-org override) governs whether discovery runs.

app/modules/auth/providers/zitadel/index.ts

@@ -77,6 +77,9 @@ export class ZitadelAuthProvider implements AuthProvider {
   getActiveIdPs(orgId?: string): Promise<IdProvider[]> {
     return settings.getActiveIdPs(this.ctx, orgId);
   }
+  getDefaultOrg(): Promise<string | null> {
+    return user.getDefaultOrg(this.ctx);
+  }
 
   // users
   findUser(identifier: string, orgId?: string): Promise<User | null> {

app/modules/auth/providers/zitadel/user.ts

@@ -78,6 +78,27 @@ export function findOrgByDomain(
   });
 }
 
+export function getDefaultOrg(ctx: ZitadelCtx): Promise<string | null> {
+  // Instance Default Organization lookup (org-first / default-org fallback). Filters
+  // OrganizationService.ListOrganizations by the instance defaultQuery and returns the first
+  // match's id. Reuses the same OrganizationService client as findOrgByDomain.
+  //   filter SearchQuery.query = { case: 'defaultQuery', value: {} }  (OrganizationDefaultQuery)
+  //   response ListOrganizationsResponse { result: Organization[] }  (Organization.id: string)
+  const orgs = ctx.svc(OrganizationService);
+  return ctx.call(async () => {
+    const req = create(ListOrganizationsRequestSchema, {
+      queries: [
+        create(OrgSearchQuerySchema, {
+          query: { case: 'defaultQuery', value: {} },
+        }),
+      ],
+    });
+    const resp = await orgs.listOrganizations(req);
+    const result = resp.result ?? [];
+    return result[0]?.id ?? null;
+  });
+}
+
 export function getUser(ctx: ZitadelCtx, id: string): Promise<User | null> {
   const users = ctx.svc(UserService);
   return ctx.call(async () => {

app/modules/i18n/locales/en.po

@@ -64,7 +64,7 @@ msgstr "Additional verification is required to continue."
 msgid "Already have an account?"
 msgstr "Already have an account?"
 
-#: app/routes/login/index.tsx:257
+#: app/routes/login/index.tsx:264
 msgid "An account with this email already exists — sign in to continue."
 msgstr "An account with this email already exists — sign in to continue."
 
@@ -164,7 +164,7 @@ msgstr "Choose how to sign in"
 msgid "Choose how you want to verify your identity."
 msgstr "Choose how you want to verify your identity."
 
-#: app/routes/login/index.tsx:253
+#: app/routes/login/index.tsx:260
 msgid "Choose your login method"
 msgstr "Choose your login method"
 
@@ -186,7 +186,7 @@ msgid "Connected accounts"
 msgstr "Connected accounts"
 
 #: app/routes/device/index.tsx:73
-#: app/routes/login/index.tsx:334
+#: app/routes/login/index.tsx:341
 #: app/routes/signup/index.tsx:269
 msgid "Continue"
 msgstr "Continue"
@@ -211,7 +211,7 @@ msgstr "Couldn't sign in"
 msgid "Create a new account"
 msgstr "Create a new account"
 
-#: app/routes/login/index.tsx:365
+#: app/routes/login/index.tsx:372
 #: app/routes/signup/password.tsx:189
 msgid "Create account"
 msgstr "Create account"
@@ -233,8 +233,8 @@ msgstr "Device code"
 msgid "Device denied"
 msgstr "Device denied"
 
-#: app/routes/login/index.tsx:210
-#: app/routes/login/index.tsx:307
+#: app/routes/login/index.tsx:217
+#: app/routes/login/index.tsx:314
 #: app/routes/signup/index.tsx:230
 #: app/routes/signup/index.tsx:255
 msgid "Email"
@@ -244,7 +244,7 @@ msgstr "Email"
 msgid "Email code"
 msgstr "Email code"
 
-#: app/routes/login/index.tsx:343
+#: app/routes/login/index.tsx:350
 #: app/routes/login/method.tsx:113
 #: app/routes/signup/method.tsx:263
 msgid "Email me a sign-in link"
@@ -266,7 +266,7 @@ msgstr "Email OTP"
 msgid "Email sign-in isn't available — use your username."
 msgstr "Email sign-in isn't available — use your username."
 
-#: app/routes/login/index.tsx:209
+#: app/routes/login/index.tsx:216
 msgid "Email, phone, or username"
 msgstr "Email, phone, or username"
 
@@ -372,7 +372,7 @@ msgstr "No sign-in method is available for this account."
 msgid "No signed-in accounts."
 msgstr "No signed-in accounts."
 
-#: app/routes/login/index.tsx:363
+#: app/routes/login/index.tsx:370
 msgid "Not registered?"
 msgstr "Not registered?"
 
@@ -392,7 +392,7 @@ msgstr "or"
 msgid "Or import this URI in your authenticator app"
 msgstr "Or import this URI in your authenticator app"
 
-#: app/routes/login/index.tsx:288
+#: app/routes/login/index.tsx:295
 #: app/routes/login/method.tsx:98
 #: app/routes/setup/mfa.tsx:46
 msgid "Passkey"
@@ -428,7 +428,7 @@ msgstr "Password must contain an uppercase letter."
 msgid "Password sign-in isn't available for this account."
 msgstr "Password sign-in isn't available for this account."
 
-#: app/routes/login/index.tsx:212
+#: app/routes/login/index.tsx:219
 msgid "Phone"
 msgstr "Phone"
 
@@ -565,7 +565,7 @@ msgstr "Sign in with LDAP"
 msgid "Sign out"
 msgstr "Sign out"
 
-#: app/routes/login/index.tsx:353
+#: app/routes/login/index.tsx:360
 msgid "Sign-in is currently unavailable for this account. Please contact your administrator."
 msgstr "Sign-in is currently unavailable for this account. Please contact your administrator."
 
@@ -687,7 +687,7 @@ msgstr "Use your passkey to verify your identity."
 msgid "Use your security key to verify your identity."
 msgstr "Use your security key to verify your identity."
 
-#: app/routes/login/index.tsx:213
+#: app/routes/login/index.tsx:220
 #: app/routes/sso/ldap.tsx:73
 msgid "Username"
 msgstr "Username"
@@ -761,7 +761,7 @@ msgstr "We've sent a password reset link to <0>{0}</0>"
 msgid "We've sent a verification link to <0>{0}</0>"
 msgstr "We've sent a verification link to <0>{0}</0>"
 
-#: app/routes/login/index.tsx:250
+#: app/routes/login/index.tsx:257
 msgid "Welcome"
 msgstr "Welcome"
 

app/resources/authorize/authorize-decision.ts

@@ -24,15 +24,25 @@ export interface AuthorizeInput {
   authRequest: AuthRequest;
   hasSessions: boolean;
   validSessionId?: string;
+  /**
+   * The effective organization, pre-resolved by the impure caller (resolveOidc → resolveOrg:
+   * scope-org → env pin → provider default org). When provided it OVERRIDES the scope-derived org,
+   * so a default-org fallback threads `organization` into the /login (and /signup, /accounts)
+   * redirect even when the OIDC request carried no org-id scope. Omitted ⇒ this stays pure and
+   * derives the org from scopes exactly as before (unchanged behaviour for existing callers/tests).
+   */
+  organization?: string;
 }
 
 // target 'callback' means: call createCallback(validSessionId); 'error' carries .error.
 export function decideAuthorize({
   authRequest,
   hasSessions,
   validSessionId,
+  organization,
 }: AuthorizeInput): AuthorizeDecision {
-  const org = deriveOrganizationFromScopes(authRequest.scopes);
+  // Pre-resolved org (default-org fallback) wins; else derive from scopes (legacy behaviour).
+  const org = organization ?? deriveOrganizationFromScopes(authRequest.scopes);
   const baseParams = org ? { organization: org } : undefined;
 
   if (authRequest.prompt.includes('create')) return { target: '/signup', params: baseParams };

app/resources/authorize/authorize.service.ts

@@ -21,8 +21,12 @@ import {
   type SessionEntry,
 } from '@/modules/auth/session/cookie';
 import { ProviderError, type Session } from '@/modules/auth/types';
-import { decideAuthorize } from '@/resources/authorize/authorize-decision';
+import {
+  decideAuthorize,
+  deriveOrganizationFromScopes,
+} from '@/resources/authorize/authorize-decision';
 import { primaryFresh } from '@/resources/shared/lifetimes';
+import { resolveOrg } from '@/resources/shared/resolve-org';
 import { logAuthEvent } from '@/server/observability';
 import { type AuthErrorCode, providerErrorCode } from '@/utils/errors/auth-error';
 import { redirect } from 'react-router';
@@ -338,10 +342,16 @@ async function resolveOidc(
   }
 
   const recent = mostRecent(list);
+  // Org-first / default-org fallback: when the OIDC request carries no org-id scope, resolve the
+  // instance default org (env pin → provider default) so the bootstrap redirect (/login, /signup,
+  // /accounts) still threads `organization` and the login renders the real org's IdPs instead of
+  // the INSTANCE/default context. An explicit scope org always wins (resolveOrg is org-first).
+  const organization = await resolveOrg(provider, deriveOrganizationFromScopes(authRequest.scopes));
   const decision = decideAuthorize({
     authRequest,
     hasSessions: list.length > 0,
     validSessionId: recent?.id,
+    organization,
   });
 
   if (decision.target === 'callback') {

app/resources/shared/resolve-org.ts

@@ -0,0 +1,51 @@
+// app/resources/shared/resolve-org.ts
+//
+// Org-first, default-org fallback resolution for the login / authorize flows.
+//
+// Datum's OIDC requests do NOT carry the `urn:zitadel:iam:org:id:<id>` scope, and the rebuild
+// resolved the login org ONLY from that scope — so `org` came back undefined, makeReqCtx(undefined)
+// fell through to the INSTANCE/default context, and /login rendered the instance IdPs instead of the
+// Datum Cloud org IdPs. This restores the old app's `getDefaultOrg()` fallback: prefer an explicit
+// org (URL param / OIDC org-id scope), then an ops env pin, then the provider's instance Default
+// Organization. The INSTANCE/default context (undefined) remains ONLY as the last resort, when the
+// provider itself has no default org.
+import type { AuthProvider } from '@/modules/auth/auth-provider';
+import { env } from '@/server/infra/env.server';
+
+// Module-level memo of the provider's instance Default Organization. It is STABLE for the life of
+// the process, so one lookup serves every request. A `null` result (provider returned no default)
+// is deliberately NOT cached — the next call retries, so a transient miss never pins us to the
+// instance/default context permanently.
+let cachedDefaultOrg: string | null = null;
+
+/**
+ * Memoized read of the provider's instance Default Organization. Only a NON-null id is cached; a
+ * null result is returned but left uncached so the next call retries. The provider is injected
+ * (not module-global) to keep this unit-testable.
+ */
+export async function getCachedDefaultOrg(provider: AuthProvider): Promise<string | null> {
+  if (cachedDefaultOrg !== null) return cachedDefaultOrg;
+  const resolved = await provider.getDefaultOrg();
+  if (resolved !== null) cachedDefaultOrg = resolved;
+  return resolved;
+}
+
+/** Test-only: clear the module cache so precedence/caching specs start from a clean slate. */
+export function resetDefaultOrgCache(): void {
+  cachedDefaultOrg = null;
+}
+
+/**
+ * Resolve the effective organization for a login/authorize flow — org-first, with a default-org
+ * fallback:
+ *   1. an explicit org (URL `?organization=` / OIDC org-id scope) always wins;
+ *   2. else the `ZITADEL_DEFAULT_ORG_ID` env pin (ops override; no provider round-trip);
+ *   3. else the provider's cached instance Default Organization;
+ *   4. else `undefined` → INSTANCE/default context (last resort).
+ */
+export async function resolveOrg(
+  provider: AuthProvider,
+  urlOrg?: string
+): Promise<string | undefined> {
+  return urlOrg ?? env.ZITADEL_DEFAULT_ORG_ID ?? (await getCachedDefaultOrg(provider)) ?? undefined;
+}

app/routes/login/index.tsx

@@ -21,6 +21,7 @@ import {
   isPhoneLike,
   makeLoginIdentifierClientSchema,
 } from '@/resources/login/login.schema';
+import { resolveOrg } from '@/resources/shared/resolve-org';
 import { paths } from '@/routes/paths';
 import { providerForRequest } from '@/server/auth-context.server';
 import { loaderCsrf, assertCsrf } from '@/server/csrf';
@@ -55,7 +56,13 @@ export async function loader({ request }: LoaderFunctionArgs) {
     return redirect(`${paths.authorize()}${url.search}`);
   }
 
-  const organization = url.searchParams.get('organization') ?? undefined;
+  // Org-first with a default-org fallback: an explicit `?organization=` wins, else the env pin,
+  // else the provider's instance Default Organization. Without this the org came back undefined and
+  // the loader rendered the INSTANCE/default IdPs instead of the real org's IdPs.
+  const organization = await resolveOrg(
+    provider,
+    url.searchParams.get('organization') ?? undefined
+  );
   const [settings, branding, idps] = await Promise.all([
     provider.getLoginSettings(organization),
     provider.getBranding(organization),

app/server/infra/env.server.ts

@@ -29,6 +29,11 @@ const schema = z
     // no extra headers. (Renamed from the fork's `CUSTOM_REQUEST_HEADERS` — Zitadel-only,
     // so it now carries the ZITADEL_ prefix like the other transport vars.)
     ZITADEL_CUSTOM_REQUEST_HEADERS: z.string().optional(),
+    // Optional ops pin for the org-first / default-org fallback (resolveOrg). When set, a login
+    // without an explicit `?organization=` (or OIDC org-id scope) uses THIS org id instead of
+    // calling the provider's getDefaultOrg. Unset (default) ⇒ resolveOrg falls back to the
+    // provider's instance Default Organization. No default value.
+    ZITADEL_DEFAULT_ORG_ID: z.string().optional(),
     // Fallback destination after a standalone login (e.g. when no ?redirect param
     // is present). Optional — unset in dev/test; the route supplies its own default.
     DEFAULT_APP_URL: z.url().optional(),