I have a non-salesforce web application, and I want to secure it so only users of my SF org can use it. The data that I want to protect is stored in the web app, so my SF org should only serve as a SSO identitiy provider.
I have set up a connected app in my org and configured the web app with the client key and client secret. Now my web app redirects to salesforce for login, receives the token and all looks fine. Except all of the above is true for all salesforce orgs, not just mine - anybody with any salesforce login can log into my application.
I tried to verify the signature of the token message, hoping that other orgs won't have access to the client secret, but even that matches.