Method manualOrganizationMembership

coderd/members.go:607–616

manualOrganizationMembership checks if the user is an OIDC user and if organization sync is enabled. If organization sync is enabled, manual organization assignment is not allowed, since all organization membership is controlled by the external IDP.

(ctx context.Context, rw http.ResponseWriter, user database.User)

// If organization sync is enabled, manual organization assignment is not allowed,
// since all organization membership is controlled by the external IDP.
func (api *API) manualOrganizationMembership(ctx context.Context, rw http.ResponseWriter, user database.User) bool {
	if user.LoginType == database.LoginTypeOIDC && api.IDPSync.OrganizationSyncEnabled(ctx, api.Database) {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
			Message: "Organization sync is enabled for OIDC users, meaning manual organization assignment is not allowed for this user. Have the user re-login to refresh their organizations.",
			Detail:  fmt.Sprintf("User %s is an OIDC user and organization sync is enabled. Ask an administrator to resolve the membership in your external IDP.", user.Username),
		})
		return false
	}
	return true
}