chore: implement organization sync and create idpsync package (#14432)

* chore: implement filters for the organizations query
* chore: implement organization sync and create idpsync package

Organization sync can now be configured to assign users to an org based on oidc claims.

enterprise/coderd/coderd.go

@@ -16,8 +16,10 @@ import (
 	"github.com/coder/coder/v2/coderd/appearance"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/entitlements"
+	"github.com/coder/coder/v2/coderd/idpsync"
 	agplportsharing "github.com/coder/coder/v2/coderd/portsharing"
 	"github.com/coder/coder/v2/coderd/rbac/policy"
+	"github.com/coder/coder/v2/enterprise/coderd/enidpsync"
 	"github.com/coder/coder/v2/enterprise/coderd/portsharing"
 
 	"golang.org/x/xerrors"
@@ -78,6 +80,13 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 	if options.Entitlements == nil {
 		options.Entitlements = entitlements.New()
 	}
+	if options.IDPSync == nil {
+		options.IDPSync = enidpsync.NewSync(options.Logger, options.Entitlements, idpsync.SyncSettings{
+			OrganizationField:         options.DeploymentValues.OIDC.OrganizationField.Value(),
+			OrganizationMapping:       options.DeploymentValues.OIDC.OrganizationMapping.Value,
+			OrganizationAssignDefault: options.DeploymentValues.OIDC.OrganizationAssignDefault.Value(),
+		})
+	}
 
 	ctx, cancelFunc := context.WithCancel(ctx)
 

enterprise/coderd/enidpsync/enidpsync.go

@@ -0,0 +1,25 @@
+package enidpsync
+
+import (
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/coderd/entitlements"
+	"github.com/coder/coder/v2/coderd/idpsync"
+)
+
+// EnterpriseIDPSync enabled syncing user information from an external IDP.
+// The sync is an enterprise feature, so this struct wraps the AGPL implementation
+// and extends it with enterprise capabilities. These capabilities can entirely
+// be changed in the Parsing, and leaving the "syncing" part (which holds the
+// more complex logic) to the shared AGPL implementation.
+type EnterpriseIDPSync struct {
+	entitlements *entitlements.Set
+	*idpsync.AGPLIDPSync
+}
+
+func NewSync(logger slog.Logger, set *entitlements.Set, settings idpsync.SyncSettings) *EnterpriseIDPSync {
+	return &EnterpriseIDPSync{
+		entitlements: set,
+		AGPLIDPSync:  idpsync.NewAGPLSync(logger.With(slog.F("enterprise_capable", "true")), settings),
+	}
+}

enterprise/coderd/enidpsync/organizations.go

@@ -0,0 +1,73 @@
+package enidpsync
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/google/uuid"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/idpsync"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+func (e EnterpriseIDPSync) OrganizationSyncEnabled() bool {
+	return e.entitlements.Enabled(codersdk.FeatureMultipleOrganizations) && e.OrganizationField != ""
+}
+
+func (e EnterpriseIDPSync) ParseOrganizationClaims(ctx context.Context, mergedClaims jwt.MapClaims) (idpsync.OrganizationParams, *idpsync.HTTPError) {
+	if !e.OrganizationSyncEnabled() {
+		// Default to agpl if multi-org is not enabled
+		return e.AGPLIDPSync.ParseOrganizationClaims(ctx, mergedClaims)
+	}
+
+	// nolint:gocritic // all syncing is done as a system user
+	ctx = dbauthz.AsSystemRestricted(ctx)
+	userOrganizations := make([]uuid.UUID, 0)
+
+	// Pull extra organizations from the claims.
+	if e.OrganizationField != "" {
+		organizationRaw, ok := mergedClaims[e.OrganizationField]
+		if ok {
+			parsedOrganizations, err := idpsync.ParseStringSliceClaim(organizationRaw)
+			if err != nil {
+				return idpsync.OrganizationParams{}, &idpsync.HTTPError{
+					Code:                 http.StatusBadRequest,
+					Msg:                  "Failed to sync organizations from the OIDC claims",
+					Detail:               err.Error(),
+					RenderStaticPage:     false,
+					RenderDetailMarkdown: false,
+				}
+			}
+
+			// Keep track of which claims are not mapped for debugging purposes.
+			var ignored []string
+			for _, parsedOrg := range parsedOrganizations {
+				if mappedOrganization, ok := e.OrganizationMapping[parsedOrg]; ok {
+					// parsedOrg is in the mapping, so add the mapped organizations to the
+					// user's organizations.
+					userOrganizations = append(userOrganizations, mappedOrganization...)
+				} else {
+					ignored = append(ignored, parsedOrg)
+				}
+			}
+
+			e.Logger.Debug(ctx, "parsed organizations from claim",
+				slog.F("len", len(parsedOrganizations)),
+				slog.F("ignored", ignored),
+				slog.F("organizations", parsedOrganizations),
+			)
+		}
+	}
+
+	return idpsync.OrganizationParams{
+		// If the field is not set, then sync is not enabled.
+		SyncEnabled:    e.OrganizationField != "",
+		IncludeDefault: e.OrganizationAssignDefault,
+		// Do not return duplicates
+		Organizations: slice.Unique(userOrganizations),
+	}, nil
+}

enterprise/coderd/enidpsync/organizations_test.go

@@ -0,0 +1,272 @@
+package enidpsync_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/google/uuid"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/require"
+
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/entitlements"
+	"github.com/coder/coder/v2/coderd/idpsync"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/enidpsync"
+	"github.com/coder/coder/v2/testutil"
+)
+
+type ExpectedUser struct {
+	SyncError     bool
+	Organizations []uuid.UUID
+}
+
+type Expectations struct {
+	Name   string
+	Claims jwt.MapClaims
+	// Parse
+	ParseError     func(t *testing.T, httpErr *idpsync.HTTPError)
+	ExpectedParams idpsync.OrganizationParams
+	// Mutate allows mutating the user before syncing
+	Mutate func(t *testing.T, db database.Store, user database.User)
+	Sync   ExpectedUser
+}
+
+type OrganizationSyncTestCase struct {
+	Settings     idpsync.SyncSettings
+	Entitlements *entitlements.Set
+	Exps         []Expectations
+}
+
+func TestOrganizationSync(t *testing.T) {
+	t.Parallel()
+
+	if dbtestutil.WillUsePostgres() {
+		t.Skip("Skipping test because it populates a lot of db entries, which is slow on postgres")
+	}
+
+	requireUserOrgs := func(t *testing.T, db database.Store, user database.User, expected []uuid.UUID) {
+		t.Helper()
+
+		// nolint:gocritic // in testing
+		members, err := db.OrganizationMembers(dbauthz.AsSystemRestricted(context.Background()), database.OrganizationMembersParams{
+			UserID: user.ID,
+		})
+		require.NoError(t, err)
+
+		foundIDs := db2sdk.List(members, func(m database.OrganizationMembersRow) uuid.UUID {
+			return m.OrganizationMember.OrganizationID
+		})
+		require.ElementsMatch(t, expected, foundIDs, "match user organizations")
+	}
+
+	entitled := entitlements.New()
+	entitled.Update(func(entitlements *codersdk.Entitlements) {
+		entitlements.Features[codersdk.FeatureMultipleOrganizations] = codersdk.Feature{
+			Entitlement: codersdk.EntitlementEntitled,
+			Enabled:     true,
+			Limit:       nil,
+			Actual:      nil,
+		}
+	})
+
+	testCases := []struct {
+		Name string
+		Case func(t *testing.T, db database.Store) OrganizationSyncTestCase
+	}{
+		{
+			Name: "SingleOrgDeployment",
+			Case: func(t *testing.T, db database.Store) OrganizationSyncTestCase {
+				def, _ := db.GetDefaultOrganization(context.Background())
+				other := dbgen.Organization(t, db, database.Organization{})
+				return OrganizationSyncTestCase{
+					Entitlements: entitled,
+					Settings: idpsync.SyncSettings{
+						OrganizationField:         "",
+						OrganizationMapping:       nil,
+						OrganizationAssignDefault: true,
+					},
+					Exps: []Expectations{
+						{
+							Name:   "NoOrganizations",
+							Claims: jwt.MapClaims{},
+							ExpectedParams: idpsync.OrganizationParams{
+								SyncEnabled:    false,
+								IncludeDefault: true,
+								Organizations:  []uuid.UUID{},
+							},
+							Sync: ExpectedUser{
+								Organizations: []uuid.UUID{},
+							},
+						},
+						{
+							Name:   "AlreadyInOrgs",
+							Claims: jwt.MapClaims{},
+							ExpectedParams: idpsync.OrganizationParams{
+								SyncEnabled:    false,
+								IncludeDefault: true,
+								Organizations:  []uuid.UUID{},
+							},
+							Mutate: func(t *testing.T, db database.Store, user database.User) {
+								dbgen.OrganizationMember(t, db, database.OrganizationMember{
+									UserID:         user.ID,
+									OrganizationID: def.ID,
+								})
+								dbgen.OrganizationMember(t, db, database.OrganizationMember{
+									UserID:         user.ID,
+									OrganizationID: other.ID,
+								})
+							},
+							Sync: ExpectedUser{
+								Organizations: []uuid.UUID{def.ID, other.ID},
+							},
+						},
+					},
+				}
+			},
+		},
+		{
+			Name: "MultiOrgWithDefault",
+			Case: func(t *testing.T, db database.Store) OrganizationSyncTestCase {
+				def, _ := db.GetDefaultOrganization(context.Background())
+				one := dbgen.Organization(t, db, database.Organization{})
+				two := dbgen.Organization(t, db, database.Organization{})
+				three := dbgen.Organization(t, db, database.Organization{})
+				return OrganizationSyncTestCase{
+					Entitlements: entitled,
+					Settings: idpsync.SyncSettings{
+						OrganizationField: "organizations",
+						OrganizationMapping: map[string][]uuid.UUID{
+							"first":  {one.ID},
+							"second": {two.ID},
+							"third":  {three.ID},
+						},
+						OrganizationAssignDefault: true,
+					},
+					Exps: []Expectations{
+						{
+							Name:   "NoOrganizations",
+							Claims: jwt.MapClaims{},
+							ExpectedParams: idpsync.OrganizationParams{
+								SyncEnabled:    true,
+								IncludeDefault: true,
+								Organizations:  []uuid.UUID{},
+							},
+							Sync: ExpectedUser{
+								Organizations: []uuid.UUID{def.ID},
+							},
+						},
+						{
+							Name: "AlreadyInOrgs",
+							Claims: jwt.MapClaims{
+								"organizations": []string{"second", "extra"},
+							},
+							ExpectedParams: idpsync.OrganizationParams{
+								SyncEnabled:    true,
+								IncludeDefault: true,
+								Organizations:  []uuid.UUID{two.ID},
+							},
+							Mutate: func(t *testing.T, db database.Store, user database.User) {
+								dbgen.OrganizationMember(t, db, database.OrganizationMember{
+									UserID:         user.ID,
+									OrganizationID: def.ID,
+								})
+								dbgen.OrganizationMember(t, db, database.OrganizationMember{
+									UserID:         user.ID,
+									OrganizationID: one.ID,
+								})
+							},
+							Sync: ExpectedUser{
+								Organizations: []uuid.UUID{def.ID, two.ID},
+							},
+						},
+						{
+							Name: "ManyClaims",
+							Claims: jwt.MapClaims{
+								// Add some repeats
+								"organizations": []string{"second", "extra", "first", "third", "second", "second"},
+							},
+							ExpectedParams: idpsync.OrganizationParams{
+								SyncEnabled:    true,
+								IncludeDefault: true,
+								Organizations: []uuid.UUID{
+									two.ID, one.ID, three.ID,
+								},
+							},
+							Mutate: func(t *testing.T, db database.Store, user database.User) {
+								dbgen.OrganizationMember(t, db, database.OrganizationMember{
+									UserID:         user.ID,
+									OrganizationID: def.ID,
+								})
+								dbgen.OrganizationMember(t, db, database.OrganizationMember{
+									UserID:         user.ID,
+									OrganizationID: one.ID,
+								})
+							},
+							Sync: ExpectedUser{
+								Organizations: []uuid.UUID{def.ID, one.ID, two.ID, three.ID},
+							},
+						},
+					},
+				}
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.Name, func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitMedium)
+			logger := slogtest.Make(t, &slogtest.Options{})
+
+			rdb, _ := dbtestutil.NewDB(t)
+			db := dbauthz.New(rdb, rbac.NewAuthorizer(prometheus.NewRegistry()), logger, coderdtest.AccessControlStorePointer())
+			caseData := tc.Case(t, rdb)
+			if caseData.Entitlements == nil {
+				caseData.Entitlements = entitlements.New()
+			}
+
+			// Create a new sync object
+			sync := enidpsync.NewSync(logger, caseData.Entitlements, caseData.Settings)
+			for _, exp := range caseData.Exps {
+				t.Run(exp.Name, func(t *testing.T) {
+					params, httpErr := sync.ParseOrganizationClaims(ctx, exp.Claims)
+					if exp.ParseError != nil {
+						exp.ParseError(t, httpErr)
+						return
+					}
+					require.Nil(t, httpErr, "no parse error")
+
+					require.Equal(t, exp.ExpectedParams.SyncEnabled, params.SyncEnabled, "match enabled")
+					require.Equal(t, exp.ExpectedParams.IncludeDefault, params.IncludeDefault, "match include default")
+					if exp.ExpectedParams.Organizations == nil {
+						exp.ExpectedParams.Organizations = []uuid.UUID{}
+					}
+					require.ElementsMatch(t, exp.ExpectedParams.Organizations, params.Organizations, "match organizations")
+
+					user := dbgen.User(t, db, database.User{})
+					if exp.Mutate != nil {
+						exp.Mutate(t, rdb, user)
+					}
+
+					err := sync.SyncOrganizations(ctx, rdb, user, params)
+					if exp.Sync.SyncError {
+						require.Error(t, err)
+						return
+					}
+					require.NoError(t, err)
+					requireUserOrgs(t, db, user, exp.Sync.Organizations)
+				})
+			}
+		})
+	}
+}

enterprise/coderd/userauth_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/golang-jwt/jwt/v4"
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
@@ -14,7 +15,9 @@ import (
 	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/coderd/coderdtest/oidctest"
 	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
 	"github.com/coder/coder/v2/coderd/database/dbtestutil"
 	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/coderd/util/slice"
@@ -23,11 +26,208 @@ import (
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 	"github.com/coder/coder/v2/enterprise/coderd/license"
 	"github.com/coder/coder/v2/testutil"
+	"github.com/coder/serpent"
 )
 
 // nolint:bodyclose
 func TestUserOIDC(t *testing.T) {
 	t.Parallel()
+
+	t.Run("OrganizationSync", func(t *testing.T) {
+		t.Parallel()
+
+		t.Run("SingleOrgDeployment", func(t *testing.T) {
+			t.Parallel()
+
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.UserRoleField = "roles"
+				},
+			})
+
+			claims := jwt.MapClaims{
+				"email": "alice@coder.com",
+			}
+
+			// Login a new client that signs up
+			client, resp := runner.Login(t, claims)
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertOrganizations(t, "alice", true, nil)
+
+			// Force a refresh, and assert nothing has changes
+			runner.ForceRefresh(t, client, claims)
+			runner.AssertOrganizations(t, "alice", true, nil)
+		})
+
+		t.Run("MultiOrgNoSync", func(t *testing.T) {
+			t.Parallel()
+
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+				},
+			})
+
+			ctx := testutil.Context(t, testutil.WaitMedium)
+			second, err := runner.AdminClient.CreateOrganization(ctx, codersdk.CreateOrganizationRequest{
+				Name:        "second",
+				DisplayName: "",
+				Description: "",
+				Icon:        "",
+			})
+			require.NoError(t, err)
+
+			claims := jwt.MapClaims{
+				"email": "alice@coder.com",
+			}
+
+			// Login a new client that signs up
+			_, resp := runner.Login(t, claims)
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertOrganizations(t, "alice", true, nil)
+
+			// Add alice to new org
+			_, err = runner.AdminClient.PostOrganizationMember(ctx, second.ID, "alice")
+			require.NoError(t, err)
+
+			// Log in again to refresh the sync. The user should not be removed
+			// from the second organization.
+			runner.Login(t, claims)
+			runner.AssertOrganizations(t, "alice", true, []uuid.UUID{second.ID})
+		})
+
+		t.Run("MultiOrgWithDefault", func(t *testing.T) {
+			t.Parallel()
+
+			// Chicken and egg problem. Config is at startup, but orgs are
+			// created at runtime. We should add a runtime configuration of
+			// this.
+			second := uuid.New()
+			third := uuid.New()
+
+			// Given: 4 organizations: default, second, third, and fourth
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+				},
+				DeploymentValues: func(dv *codersdk.DeploymentValues) {
+					dv.OIDC.OrganizationAssignDefault = true
+					dv.OIDC.OrganizationField = "organization"
+					dv.OIDC.OrganizationMapping = serpent.Struct[map[string][]uuid.UUID]{
+						Value: map[string][]uuid.UUID{
+							"second": {second},
+							"third":  {third},
+						},
+					}
+				},
+			})
+			dbgen.Organization(t, runner.API.Database, database.Organization{
+				ID: second,
+			})
+			dbgen.Organization(t, runner.API.Database, database.Organization{
+				ID: third,
+			})
+			fourth := dbgen.Organization(t, runner.API.Database, database.Organization{})
+
+			ctx := testutil.Context(t, testutil.WaitMedium)
+			claims := jwt.MapClaims{
+				"email":        "alice@coder.com",
+				"organization": []string{"second", "third"},
+			}
+
+			// Then: a new user logs in with claims "second" and "third", they
+			// should belong to [default, second, third].
+			userClient, resp := runner.Login(t, claims)
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertOrganizations(t, "alice", true, []uuid.UUID{second, third})
+			user, err := userClient.User(ctx, codersdk.Me)
+			require.NoError(t, err)
+
+			// When: they are manually added to the fourth organization, a new sync
+			// should remove them.
+			_, err = runner.AdminClient.PostOrganizationMember(ctx, fourth.ID, "alice")
+			require.ErrorContains(t, err, "Organization sync is enabled")
+
+			runner.AssertOrganizations(t, "alice", true, []uuid.UUID{second, third})
+			// Go around the block to add the user to see if they are removed.
+			dbgen.OrganizationMember(t, runner.API.Database, database.OrganizationMember{
+				UserID:         user.ID,
+				OrganizationID: fourth.ID,
+			})
+			runner.AssertOrganizations(t, "alice", true, []uuid.UUID{second, third, fourth.ID})
+
+			// Then: Log in again will resync the orgs to their updated
+			// claims.
+			runner.Login(t, jwt.MapClaims{
+				"email":        "alice@coder.com",
+				"organization": []string{"third"},
+			})
+			runner.AssertOrganizations(t, "alice", true, []uuid.UUID{third})
+		})
+
+		t.Run("MultiOrgWithoutDefault", func(t *testing.T) {
+			t.Parallel()
+
+			second := uuid.New()
+			third := uuid.New()
+
+			// Given: 4 organizations: default, second, third, and fourth
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+				},
+				DeploymentValues: func(dv *codersdk.DeploymentValues) {
+					dv.OIDC.OrganizationAssignDefault = false
+					dv.OIDC.OrganizationField = "organization"
+					dv.OIDC.OrganizationMapping = serpent.Struct[map[string][]uuid.UUID]{
+						Value: map[string][]uuid.UUID{
+							"second": {second},
+							"third":  {third},
+						},
+					}
+				},
+			})
+			dbgen.Organization(t, runner.API.Database, database.Organization{
+				ID: second,
+			})
+			dbgen.Organization(t, runner.API.Database, database.Organization{
+				ID: third,
+			})
+			fourth := dbgen.Organization(t, runner.API.Database, database.Organization{})
+
+			ctx := testutil.Context(t, testutil.WaitMedium)
+			claims := jwt.MapClaims{
+				"email":        "alice@coder.com",
+				"organization": []string{"second", "third"},
+			}
+
+			// Then: a new user logs in with claims "second" and "third", they
+			// should belong to [ second, third].
+			userClient, resp := runner.Login(t, claims)
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertOrganizations(t, "alice", false, []uuid.UUID{second, third})
+			user, err := userClient.User(ctx, codersdk.Me)
+			require.NoError(t, err)
+
+			// When: they are manually added to the fourth organization, a new sync
+			// should remove them.
+			dbgen.OrganizationMember(t, runner.API.Database, database.OrganizationMember{
+				UserID:         user.ID,
+				OrganizationID: fourth.ID,
+			})
+			runner.AssertOrganizations(t, "alice", false, []uuid.UUID{second, third, fourth.ID})
+
+			// Then: Log in again will resync the orgs to their updated
+			// claims.
+			runner.Login(t, jwt.MapClaims{
+				"email":        "alice@coder.com",
+				"organization": []string{"third"},
+			})
+			runner.AssertOrganizations(t, "alice", false, []uuid.UUID{third})
+		})
+	})
+
 	t.Run("RoleSync", func(t *testing.T) {
 		t.Parallel()
 
@@ -54,6 +254,8 @@ func TestUserOIDC(t *testing.T) {
 			// Force a refresh, and assert nothing has changes
 			runner.ForceRefresh(t, client, claims)
 			runner.AssertRoles(t, "alice", []string{})
+
+			runner.AssertOrganizations(t, "alice", true, nil)
 		})
 
 		// Some IDPs (ADFS) send the "string" type vs "[]string" if only
@@ -81,6 +283,7 @@ func TestUserOIDC(t *testing.T) {
 			})
 			require.Equal(t, http.StatusOK, resp.StatusCode)
 			runner.AssertRoles(t, "alice", []string{rbac.RoleTemplateAdmin().String()})
+			runner.AssertOrganizations(t, "alice", true, nil)
 		})
 
 		// A user has some roles, then on an oauth refresh will lose said
@@ -118,6 +321,7 @@ func TestUserOIDC(t *testing.T) {
 				"roles": []string{"random"},
 			})
 			runner.AssertRoles(t, "alice", []string{})
+			runner.AssertOrganizations(t, "alice", true, nil)
 		})
 
 		// A user has some roles, then on another oauth login will lose said
@@ -153,6 +357,7 @@ func TestUserOIDC(t *testing.T) {
 			require.Equal(t, http.StatusOK, resp.StatusCode)
 
 			runner.AssertRoles(t, "alice", []string{})
+			runner.AssertOrganizations(t, "alice", true, nil)
 		})
 
 		// All manual role updates should fail when role sync is enabled.
@@ -214,6 +419,7 @@ func TestUserOIDC(t *testing.T) {
 			})
 			require.Equal(t, http.StatusOK, resp.StatusCode)
 			runner.AssertGroups(t, "alice", []string{groupName})
+			runner.AssertOrganizations(t, "alice", true, nil)
 		})
 
 		// Tests the group mapping feature.
@@ -245,6 +451,7 @@ func TestUserOIDC(t *testing.T) {
 			})
 			require.Equal(t, http.StatusOK, resp.StatusCode)
 			runner.AssertGroups(t, "alice", []string{coderGroupName})
+			runner.AssertOrganizations(t, "alice", true, nil)
 		})
 
 		// User is in a group, then on an oauth refresh will lose said
@@ -284,6 +491,7 @@ func TestUserOIDC(t *testing.T) {
 				"email": "alice@coder.com",
 			})
 			runner.AssertGroups(t, "alice", []string{})
+			runner.AssertOrganizations(t, "alice", true, nil)
 		})
 
 		t.Run("AddThenRemoveOnReAuth", func(t *testing.T) {
@@ -318,6 +526,7 @@ func TestUserOIDC(t *testing.T) {
 			})
 			require.Equal(t, http.StatusOK, resp.StatusCode)
 			runner.AssertGroups(t, "alice", []string{})
+			runner.AssertOrganizations(t, "alice", true, nil)
 		})
 
 		// Updating groups where the claimed group does not exist.
@@ -795,8 +1004,31 @@ type oidcTestConfig struct {
 	Userinfo jwt.MapClaims
 
 	// Config allows modifying the Coderd OIDC configuration.
-	Config   func(cfg *coderd.OIDCConfig)
-	FakeOpts []oidctest.FakeIDPOpt
+	Config           func(cfg *coderd.OIDCConfig)
+	DeploymentValues func(dv *codersdk.DeploymentValues)
+	FakeOpts         []oidctest.FakeIDPOpt
+}
+
+func (r *oidcTestRunner) AssertOrganizations(t *testing.T, userIdent string, includeDefault bool, expected []uuid.UUID) {
+	t.Helper()
+
+	ctx := testutil.Context(t, testutil.WaitMedium)
+	userOrgs, err := r.AdminClient.OrganizationsByUser(ctx, userIdent)
+	require.NoError(t, err)
+
+	cpy := make([]uuid.UUID, 0, len(expected))
+	cpy = append(cpy, expected...)
+	hasDefault := false
+	userOrgIDs := db2sdk.List(userOrgs, func(o codersdk.Organization) uuid.UUID {
+		if o.IsDefault {
+			hasDefault = true
+			cpy = append(cpy, o.ID)
+		}
+		return o.ID
+	})
+
+	require.Equal(t, includeDefault, hasDefault, "expected default org")
+	require.ElementsMatch(t, cpy, userOrgIDs, "expected orgs")
 }
 
 func (r *oidcTestRunner) AssertRoles(t *testing.T, userIdent string, roles []string) {
@@ -856,14 +1088,21 @@ func setupOIDCTest(t *testing.T, settings oidcTestConfig) *oidcTestRunner {
 
 	ctx := testutil.Context(t, testutil.WaitMedium)
 	cfg := fake.OIDCConfig(t, nil, settings.Config)
+	dv := coderdtest.DeploymentValues(t)
+	if settings.DeploymentValues != nil {
+		settings.DeploymentValues(dv)
+	}
+	dv.Experiments = []string{string(codersdk.ExperimentMultiOrganization)}
 	owner, _, api, _ := coderdenttest.NewWithAPI(t, &coderdenttest.Options{
 		Options: &coderdtest.Options{
-			OIDCConfig: cfg,
+			OIDCConfig:       cfg,
+			DeploymentValues: dv,
 		},
 		LicenseOptions: &coderdenttest.LicenseOptions{
 			Features: license.Features{
-				codersdk.FeatureUserRoleManagement: 1,
-				codersdk.FeatureTemplateRBAC:       1,
+				codersdk.FeatureUserRoleManagement:    1,
+				codersdk.FeatureTemplateRBAC:          1,
+				codersdk.FeatureMultipleOrganizations: 1,
 			},
 		},
 	})