From 328c409271d3893d2cf752ba756f288dde056766 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20M=C3=B6hlmann?= Date: Wed, 11 Sep 2024 07:45:59 +0300 Subject: [PATCH] fix(oidc): roles in service user ID token (#8561) # Which Problems Are Solved Return the user's project roles when the `urn:zitadel:iam:org:projects:roles` scope is requested. We alreayd returned it for access tokens, now also ID tokens. # How the Problems Are Solved Set `idTokenRoleAssertion` to `true` when calling `accessTokenResponseFromSession` for service users. This parameter is normally set to the client config. However, service user authentication does not have a client. # Additional Changes - none # Additional Context - Introduced in https://github.com/zitadel/zitadel/pull/8046 - Closes https://github.com/zitadel/zitadel/issues/8107 Co-authored-by: Livio Spring --- internal/api/oidc/token_client_credentials.go | 2 +- internal/api/oidc/token_jwt_profile.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/api/oidc/token_client_credentials.go b/internal/api/oidc/token_client_credentials.go index 2ad429d2b9..459a98f8ad 100644 --- a/internal/api/oidc/token_client_credentials.go +++ b/internal/api/oidc/token_client_credentials.go @@ -51,5 +51,5 @@ func (s *Server) ClientCredentialsExchange(ctx context.Context, r *op.ClientRequ return nil, err } - return response(s.accessTokenResponseFromSession(ctx, client, session, "", "", false, true, false, false)) + return response(s.accessTokenResponseFromSession(ctx, client, session, "", "", false, true, true, false)) } diff --git a/internal/api/oidc/token_jwt_profile.go b/internal/api/oidc/token_jwt_profile.go index 92d70d33d6..d3c32604c3 100644 --- a/internal/api/oidc/token_jwt_profile.go +++ b/internal/api/oidc/token_jwt_profile.go @@ -58,7 +58,7 @@ func (s *Server) JWTProfile(ctx context.Context, r *op.Request[oidc.JWTProfileGr if err != nil { return nil, err } - return response(s.accessTokenResponseFromSession(ctx, client, session, "", "", false, true, false, false)) + return response(s.accessTokenResponseFromSession(ctx, client, session, "", "", false, true, true, false)) } func (s *Server) verifyJWTProfile(ctx context.Context, req *oidc.JWTProfileGrantRequest) (user *query.User, tokenRequest *oidc.JWTTokenRequest, err error) {