Scope signing user picker to team for multi-tenant SaaS (#6583)

2026-06-15 13:44:34 +01:00
parent 2a905c01c3
commit 9d7467cf90
6 changed files with 234 additions and 7 deletions
@@ -1005,6 +1005,10 @@ public class ApplicationProperties {
        @Data
        public static class Signing {
            private boolean enabled = false;
+
+            // Signing user-picker scope: 'org' (default) = whole instance, anything else =
+            // caller's team only (fail-closed). The saas profile pins 'team'.
+            private String userListScope = "org";
        }
    }