diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts
index e0d964017..03281baca 100644
--- a/backend/src/services/auth/auth-login-service.ts
+++ b/backend/src/services/auth/auth-login-service.ts
@@ -450,26 +450,25 @@ export const authLoginServiceFactory = ({
}
});
- // Notify all admins via email
+ // Notify all admins via email (besides the actor)
const orgAdmins = await orgDAL.findOrgMembersByRole(organizationId, OrgMembershipRole.Admin);
- const adminEmails = orgAdmins.map((admin) => admin.user?.email).filter(Boolean) as string[];
+ const adminEmails = orgAdmins
+ .filter((admin) => admin.user.id !== user.id)
+ .map((admin) => admin.user.email)
+ .filter(Boolean) as string[];
- try {
- if (adminEmails.length > 0) {
- await smtpService.sendMail({
- recipients: adminEmails,
- subjectLine: "Security Alert: Admin SSO Bypass",
- substitutions: {
- email: user.email,
- timestamp: new Date().toISOString(),
- ip: ipAddress,
- userAgent
- },
- template: SmtpTemplates.OrgAdminBreakglassAccess
- });
- }
- } catch (error) {
- logger.error(error, `Failed to send SSO bypass notification emails for user ${user.email}`);
+ if (adminEmails.length > 0) {
+ await smtpService.sendMail({
+ recipients: adminEmails,
+ subjectLine: "Security Alert: Admin SSO Bypass",
+ substitutions: {
+ email: user.email,
+ timestamp: new Date().toISOString(),
+ ip: ipAddress,
+ userAgent
+ },
+ template: SmtpTemplates.OrgAdminBreakglassAccess
+ });
}
}
diff --git a/backend/src/services/org/org-dal.ts b/backend/src/services/org/org-dal.ts
index 8aedddbdd..3f4215a6b 100644
--- a/backend/src/services/org/org-dal.ts
+++ b/backend/src/services/org/org-dal.ts
@@ -254,7 +254,7 @@ export const orgDALFactory = (db: TDbClient) => {
const findOrgMembersByRole = async (orgId: string, role: OrgMembershipRole, tx?: Knex) => {
try {
- const conn = tx || db;
+ const conn = tx || db.replicaNode();
const members = await conn(TableName.OrgMembership)
.where(`${TableName.OrgMembership}.orgId`, orgId)
.where(`${TableName.OrgMembership}.role`, role)
diff --git a/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars b/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars
index c15eb6896..0ad3bf2b5 100644
--- a/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars
+++ b/backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars
@@ -8,11 +8,11 @@
Infisical
- The organization admin {{email}} has just bypassed enforced SSO login.
+ The organization admin {{email}} has bypassed enforced SSO login.
Timestamp: {{timestamp}}
IP address: {{ip}}
User agent: {{userAgent}}
- If you'd like to disable Admin SSO Bypass, please visit Organization Settings > Security.
+ If you'd like to disable Admin SSO Bypass, please visit Organization Settings > Security.
{{emailFooter}}