From 2dc35262149b47963b840fafd37d57f25614adcd Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Fri, 4 Oct 2024 17:18:22 +0200 Subject: [PATCH] docs/auth: update sign-in resolver docs to encourage use of allowedDomains Signed-off-by: Patrik Oldsberg --- docs/auth/identity-resolver.md | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/docs/auth/identity-resolver.md b/docs/auth/identity-resolver.md index b8bcd95a5e..293300f429 100644 --- a/docs/auth/identity-resolver.md +++ b/docs/auth/identity-resolver.md @@ -132,12 +132,27 @@ GitHub provider, but you could also choose to use the resolvers, which are common to all auth providers. :::warning -When using the `emailLocalPartMatchingUserEntityName` resolver it is important -to only allow users to sign in with email addresses from expected domains. This -is typically controlled as part of the OAuth configuration in the provider -itself. +When using the `emailLocalPartMatchingUserEntityName` resolver it is strongly +recommended to set the `allowedDomains` option to ensure that only authorized users +are able to sign-in. ::: +If you are using the `emailLocalPartMatchingUserEntityName` resolver, it is +recommended to also set the `allowedDomains` option, for example: + +```yaml title="Within the provider configuration" +auth: + providers: + github: + development: + ... + signIn: + resolvers: + - resolver: emailLocalPartMatchingUserEntityName + allowedDomains: + - acme.org +``` + ### Building Custom Resolvers If the builtins don't work for you, you can also provide a completely custom