fix(oidc): define audience inside auth request instead off token creation
When using the v1 OIDC Code flow, tokens would not carry the correct audience when returned as JWT. This applies to access tokens as JWT and ID tokens.
Introspection would still show the correct audience.
This happened because project audience was appended at token creation time. This stored the appended audience, used later in introspection or token refresh. However, the OIDC library still only had a view of the original auth request with the original audience.
When signing JWTs it would use this outdated information.
This change moves audience modifications to the auth request creation. This is was already the way it was done for v2 login and now v1 follows the same method.
Co-authored-by: Livio Spring <livio.a@gmail.com>
(cherry picked from commit 9d5cd12cd4daffafb1c502db0bea603a2403e12d)
Add organizationID as query for ListUsers and clean up the deprecated Organisation attributes in other queries.
This PR removes the following fields from API requests (user service v2):
organisation from AddHumanUser (deprecated some time ago, organization still exists)
organization from GetUserByID
(cherry picked from commit 319ebe78983e30160323aa36cc9ede47d9cf40f3)
A customer noted that the login by email was case-sensitive, which differs to the handling of the loginname.
This PR changes the email check to be case-insensitive (which it was already in same parts) and improve the search for this as well.
(cherry picked from commit 7e24a1adbce724d3b999db39c005a00d5e74334d)
It was noticed multiple time (incl. customers) that the loginname is sometimes not rendered in the UI.
This PR fixes such an issue after registration of a new user from an IdP.
(cherry picked from commit b2d7352a5ac95952c7c099a295624d7078869647)
* docs: add org id header in missing requests
* docs: add org id header to proto definitions
---------
Co-authored-by: Livio Spring <livio.a@gmail.com>
feat: updated russian translations by native speaker with a user polite approach
Co-authored-by: Pavel Girilyuk <pavel.girilyuk@digitalchief.ru>
Co-authored-by: Fabi <fabienne@zitadel.com>
* feat: add projections and query side to executions and targets
* feat: add list and get endpoints for targets
* feat: add integration tests for query endpoints target and execution
* fix: linting
* fix: linting
* fix: review changes, renames and corrections
* fix: review changes, renames and corrections
* fix: review changes, renames and corrections
* fix: review changes, renames and corrections
* fix: review changes, renames and corrections
* fix: review changes, renames and corrections
* fix: remove position from list details
* feat: add ExpirationDate to MachineKey JSON detail
* fix: include time in expiration date column for machine keys table
* fix: show expiration date in ShowKeyDialog if available
* fix: add machine key expiration date note
---------
Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
This PR adds the functionality to manage user schemas through the new user schema service.
It includes the possibility to create a basic JSON schema and also provides a way on defining permissions (read, write) for owner and self context with an annotation.
Further annotations for OIDC claims and SAML attribute mappings will follow.
A guide on how to create a schema and assign permissions has been started. It will be extended though out the process of implementing the schema and users based on those.
Note:
This feature is in an early stage and therefore not enabled by default. To test it out, please enable the UserSchema feature flag on your instance / system though the feature service.
* fix(eventstore): consider `IsGlobal`-flag of constraints
* fix(setup): set `instance_domain`-constraint global
(cherry picked from commit 60ee2610f2ae67e2e33ac8c08df739c44d397809)
* docs(api): describe which flow and trigger types word together
* docs(actions): describe which flow and trigger types work together
* Update management.proto
---------
Co-authored-by: Livio Spring <livio.a@gmail.com>
Add additional permission integration tests to the user v2 query endpoints including some fixes to correctly check the permissions after the data is known which you want to query.
* fix: projection reduce correction with unit tests
* fix: remove eventcout variable as not used anymore
* fix: add errors if resoureowner is not found in user grants reduce
