We have a single web platform, where users can log in to different workspaces.
Each workspace has its own list of users with email and password credentials and various permissions for each of those users. Email and password pairs can be duplicated across the workspaces. The passwords are hashed and stored in a database alongside the user data.
There'll only be a single login page, and we'll log the user into the workspace that has matching credentials.
However, if there are multiple workspaces that have a matching email and password – we want to log them into all of those matching workspaces.
Does this pose a security issue?
Would it be best to share the password hashes across workspaces? (this would add some complexity to the app)
Or can it be done without sharing the hashes? – and simply checking the password across all workspaces for that email (where there might be different salts, but the underlying password would be the same)