Concurrent session based access control for sub organizations IS

[hwupathum]

Description

When try to implement concurrent session based access control for sub organizations using the steps defined with the official documentation[1] getting an authentication failure with an error log in the server console for a user who resides only in the sub organization.

Error Log:

[2025-02-16 16:29:13,144] [60543c4b-c8b1-4236-9d0e-e8abd6eb8a33] ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler} - Authentication failed exception! Error occurred while retrieving user sessions.

[1] - https://is.docs.wso2.com/en/latest/guides/authentication/conditional-auth/concurrent-session-based-template/

Steps to Reproduce

1. Login to console create an application and add "Sign in with SSO" as a login option in the "Login flow"
2. Create a sub organization and share the appllication created above with the sub organization
3. Switch to the sub organization and add a user to sub organization
4. Switch to parent organization and edit the application created and follow the steps provided in the official documentation[1].
5. Try to login to the application using the "Sign in with SSO" option and give the sub organization ID
6. Use the credentials of the user in the sub organization and will receive the authentication failed error.

This works for the parent organization with a parent user without any issue and will ask to terminate the old session.

Version

IS 7.1.0.-beta

Environment Details (with versions)

No response

[hwupathum]

The issue here is, during SSO login the ActiveSessionsLimitHandler tries to get the active user session from root-org since the context.getTenantDomain() [1] returns the root org value. Then an exception is thrown at [2] since username not available for the userId in the given tenant domain

[1] https://github.com/wso2-extensions/identity-local-auth-basicauth/blob/master/components/org.wso2.carbon.identity.application.authentication.handler.session/src/main/java/org/wso2/carbon/identity/application/authentication/handler/session/ActiveSessionsLimitHandler.java#L186
[2] https://github.com/wso2/carbon-identity-framework/blob/master/components/authentication-framework/org.wso2.carbon.identity.application.authentication.framework/src/main/java/org/wso2/carbon/identity/application/authentication/framework/internal/impl/UserSessionManagementServiceImpl.java#L229

[SujanSanjula96]

Fixed with wso2-extensions/identity-local-auth-basicauth#222