Service identities only have trust with their managing ORG

connector/hsdp/extend_payload.go

@@ -19,7 +19,7 @@ func (c *HSDPConnector) ExtendPayload(scopes []string, payload []byte, cdata []b
 		return payload, err
 	}
 
-	c.logger.Info("ExtendPayload called", "user", cd.Introspect.Username)
+	c.logger.Info("ExtendPayload called", "sub", cd.Introspect.Sub, "user", cd.Introspect.Username)
 
 	// Check if we have a trusted org mapping
 	aud := originalClaims["aud"].(string)
@@ -28,6 +28,11 @@ func (c *HSDPConnector) ExtendPayload(scopes []string, payload []byte, cdata []b
 		trustedOrgID = orgID
 	}
 
+	// Service identities only support their managing org as the trusted org
+	if cd.Introspect.IdentityType == "Service" {
+		trustedOrgID = cd.Introspect.Organizations.ManagingOrganization
+	}
+
 	for _, scope := range scopes {
 		// Experimental fill introspect body into claims
 		if scope == "hsp:iam:introspect" {
@@ -38,6 +43,7 @@ func (c *HSDPConnector) ExtendPayload(scopes []string, payload []byte, cdata []b
 			originalClaims["tkn"] = string(cd.AccessToken)
 		}
 	}
+	originalClaims["idt"] = cd.Introspect.IdentityType
 	originalClaims["mid"] = cd.Introspect.Organizations.ManagingOrganization
 	originalClaims["tid"] = trustedOrgID
 	// Rewrite subject