TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-08-12 01:37:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(oidc): allow returning of parent errors to client (#8376)

Browse Source 
# Which Problems Are Solved

Currently the OIDC API of ZITADEL only prints parent errors to the logs.
Where 4xx status are typically warn level and 5xx error level. This
makes it hard to debug certain errors for client in multi-instance
environments like ZITADEL cloud, where there is no direct access to
logs. In case of support requests we often can't correlate past
log-lines to the error that was reported.

This change adds the possibility to return the parent error in the
response to the OIDC client. For the moment this only applies to JSON
body responses, not error redirects to the RP.

# How the Problems Are Solved

- New instance-level feature flag: `debug_oidc_parent_error`
- Use the new `WithReturnParentToClient()` function from the oidc lib
introduced in https://github.com/zitadel/oidc/pull/629 for all cases
where `WithParent` was already used and the request context is
available.

# Additional Changes

none

# Additional Context

- Depends on: https://github.com/zitadel/oidc/pull/629
- Related to: https://github.com/zitadel/zitadel/issues/8362

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
This commit is contained in:
Tim Möhlmann
2024-08-20 09:45:24 +03:00
committed by GitHub
parent a4a2455f11
commit 5fd2061770
26 changed files with 98 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
proto/zitadel/feature/v2/instance.proto
View File

@@ -65,6 +65,13 @@ message SetInstanceFeaturesRequest{
description: "Enable the webkey/v3alpha API. The first time this feature is enabled, web keys are generated and activated.";
}
];
optional bool debug_oidc_parent_error = 9 [
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
example: "true";
description: "Return parent errors to OIDC clients for debugging purposes. Parent errors may contain sensitive data or unwanted details about the system status of zitadel. Only enable if really needed.";
}
];
}
message SetInstanceFeaturesResponse {
@@ -143,4 +150,11 @@ message GetInstanceFeaturesResponse {
description: "Enable the webkey/v3alpha API. The first time this feature is enabled, web keys are generated and activated.";
}
];
FeatureFlag debug_oidc_parent_error = 10 [
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
example: "true";
description: "Return parent errors to OIDC clients for debugging purposes. Parent errors may contain sensitive data or unwanted details about the system status of zitadel. Only enable if really needed.";
}
];
}

14
proto/zitadel/feature/v2beta/instance.proto
View File

@@ -65,6 +65,13 @@ message SetInstanceFeaturesRequest{
description: "Enable the webkey/v3alpha API. The first time this feature is enabled, web keys are generated and activated.";
}
];
optional bool debug_oidc_parent_error = 9 [
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
example: "true";
description: "Return parent errors to OIDC clients for debugging purposes. Parent errors may contain sensitive data or unwanted details about the system status of zitadel. Only enable if really needed.";
}
];
}
message SetInstanceFeaturesResponse {
@@ -143,4 +150,11 @@ message GetInstanceFeaturesResponse {
description: "Enable the webkey/v3alpha API. The first time this feature is enabled, web keys are generated and activated.";
}
];
FeatureFlag debug_oidc_parent_error = 10 [
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
example: "true";
description: "Return parent errors to OIDC clients for debugging purposes. Parent errors may contain sensitive data or unwanted details about the system status of zitadel. Only enable if really needed.";
}
];
}