Whitelist domain doesn't work

[nataliavaz]

Subject of the issue

Whitelist domain doesn't work

Steps to reproduce

Try to login with a domain that is not whitelisted.

Expected behaviour

Login should work just with the whitelisted domains

Actual behaviour

I can loggin on Matrix with any domain

[ezlage]

This same problem is happening to me too!

[juliemar]

Hi, could you share your whitelisted configuration?

[ezlage]

Sure! Thank you!

This is my configuration:

WHITELIST_DOMAINS=["lageteck.com.br","lageteck.com"]

Despite this, I can login with @gmail.com accounts. My OAuth2 configuration follows the settings above.

[nataliavaz]

My config is the same as yours.

[samuelrcarvalho]

Try to regenerate Sign-In client-id, and restart application.
I had this problem a while ago.
In that time, I thought that google changed the authentication method. After I regenerate, it worked perfectly.

[ezlage]

Thanks for your help, @samuelrcarvalho!

Unfortunately, I tried the procedure and it was still possible to connect with an account I shouldn't be able to.

[renatocmaia]

This same problem is happening to me too.

my configuration:
WHITELIST_DOMAINS=["buy4.com.br"]

[ezlage]

Because of another problem (issue #371), I switched the production environment from the master to another branch, and the problem reported here has also been solved.

git clone https://github.com/ResultadosDigitais/matrix -b '#341-add-i18n' matrix

[ezlage]

Unfortunately my happiness did not last. Taking more careful tests, I came to the conclusion that the problem persists. I'm working around the problem with this:

WHITELIST_USERS=["[email protected]","[email protected]"]

[renatocmaia]

Hello guys, I think the problem is here:
Actual code:
File: backend/app/services/auth/index.js
line 9 and 11

var isAuthorized = domainAuthorization(getAllowedDomains());
isAuthorized = userAuthorization(getAllowedUsers());

This var isAuthorized is replacing the second var.

Should be:

var isAuthorized = domainAuthorization(getAllowedDomains());

if (!isAuthorized) {
  isAuthorized = userAuthorization(getAllowedUsers());
}

After test this code work for me.