IssueTracker

This will create a public issue which anybody can view and comment on.

Please provide as much information as possible. At least, this should include a description of your issue and steps to reproduce the problem. If possible please provide a summary of what steps or workarounds you have already tried, and any docs or articles you found (un)helpful.



Problem you have encountered:

We have a setup of multiple tenancies with users, but also some users setup in the root or default tenant (without a tenant id). We have also disabled user creation and deletion.

For some authentication methods we use custom token authentication https://cloud.google.com/identity-platform/docs/multi-tenancy-authentication#creating_custom_tokens which generates custom tokens with the tenant_id claim set (or no tenant_id for those in the root tenant).

When the user logs in and receives their custom token and then uses the client libraries to sign in, if the tenant id is not explicitly set in the https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken request, the user account is created in the root tenant and the user is logged in to the root tenant, and not in the tenant specified in their custom token.



What you expected to happen:

I would expect one of the following:

Since we have disabled user account creation I would not expect the sign in with custom token call to create a user that did not already exist (the same as OIDC/SAML), if the uid does not exist in the tenant already this should be an error.

Since the custom token already has a tenant_id set I would expect an attempt to sign in to any other tenant (even the root tenant) to fail, or there be an option to set this in the Identity Platform setting. It seems strange that the client has control of this by setting/not setting the tenantId in the accounts:signInWithCustomToken call.



Steps to reproduce:

Create a custom token with a tenant_id claim set.

Call https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken with the token, but without setting the tenantId.

Other information (workarounds you have tried, documentation consulted, etc):