I've a web app which is protected via a login mechanism. There is requirement that we need to let some users login using their Salesforce credentials instead of creating accounts at the web application itself.
For this, plan is to use OpenID Connect and use the Salesforce as an Identity provider, and login users to web site.
I've created Connected App with OAuth 2.0 settings enabled, and got Consumer Key/Secret pair to be used in the process.
Process works smoothly, and I can get the authorization code/access token, and use UserInfo end point to retrieve user details as well.
However, the problem is I can login with any Salesforce user account in any organization, not limited to the organization where I created the ConnectedApp, and I receive a callback with the details related to that particular user. I need to ensure that only the users belonging to the organization where the ConnectedApp resides.
Perhaps I've not properly understood how ConnectedApps are intended to be used?
Of course I can perform an additional check with the Organization ID, and reject a login if ID is not the expected one. But is that how it's supposed to be done?
Shouldn't using the ConsumerKey, limit the user scope to the organization where the ConnectedApp is defined?