Adapt sign-in to each customer’s requirements
Define authentication requirements for the organization types your application serves. Wildo combines those application-authored requirements with the person’s account policy when they sign in.
For people in several organizations, the combined requirements matter. Your application defines the override on each organization type and controls whether its method set may narrow or expand the base policy.
Example — Meet a customer’s stronger password requirement
A member belongs to an organization requiring a longer password and MFA. Their effective policy reflects those requirements instead of relying only on the application’s basic member settings.
For engineers
Start from the user-type policy
These overrides are authored in application configuration, not a per-customer settings record. Separately managed SSO connection settings govern provider routing and enforcement.
organizationTypes[type].authOverrides can describe authentication methods, MFA, password requirements and step-up policy. Registration, lockout and session length are not organization-overridable fields in this contract.
The pure resolveAuthConfig function resolves each organization’s override against the base and then combines the results. For password bounds, the actual merge uses:
function mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {
return normalizePasswordPolicyBounds({
minLength: Math.max(a.minLength, b.minLength),
maxLength: Math.min(a.maxLength, b.maxLength),
requireUppercase: a.requireUppercase || b.requireUppercase,
requireLowercase: a.requireLowercase || b.requireLowercase,
requireNumbers: a.requireNumbers || b.requireNumbers,
requireSpecialChars: a.requireSpecialChars || b.requireSpecialChars,
expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),
});
}
Longer minimum length and shorter maximum/expiry represent different directions numerically but the same stricter intent. MFA requirement uses true-wins; a shorter enrollment grace period wins.
Decide how method changes are allowed
| Method policy | Organization behavior |
|---|---|
RESTRICT_ONLY | Narrow the base enabled methods |
EXPAND_WITHIN_SET | Add only methods from the application’s allowed expansion set |
UNRESTRICTED | Use the organization’s configured method set |
Across multiple organizations the resolved method sets are intersected. Do not assume that a method available in one membership remains available when another organization’s requirements are included.
Keep the effective policy at the point of use
The backend gathers relevant memberships and resolves policy for authentication and credential changes. Active directory management additionally disables local first-factor methods that would bypass the directory. Step-up methods can be narrowed and freshness shortened where a base step-up policy exists. Custom flows should use the effective policy rather than reading the user-type defaults alone.