zitadel/internal/api/oidc
Tim Möhlmann 9ccbbe05bc
fix(oidc): roles in userinfo for client credentials token (#7763)
* fix(oidc): roles in userinfo for client credentials token

When tokens were obtained using the client credentials grant,
with audience and role scopes, userinfo would not return the role claims. This had multiple causes:

1. There is no auth request flow, so for legacy userinfo project data was never attached to the token
2. For optimized userinfo, there is no client ID that maps to an application. The client ID for client credentials is the machine user's name. There we can't obtain a project ID. When the project ID remained empty, we always ignored the roleAudience.

This PR fixes situation 2, by always taking the roleAudience into account, even when the projectID is empty. The code responsible for the bug is also refactored to be more readable and understandable, including additional godoc.

The fix only applies to the optimized userinfo code introduced in #7706 and released in v2.50 (currently in RC). Therefore it can't be back-ported to earlier versions.

Fixes #6662

* chore(deps): update all go deps (#7764)

This change updates all go modules, including oidc, a major version of go-jose and the go 1.22 release.

* Revert "chore(deps): update all go deps" (#7772)

Revert "chore(deps): update all go deps (#7764)"

This reverts commit 6893e7d060.

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2024-04-16 13:02:38 +00:00
..
access_token.go chore(oidc): add additional spans to userinfo code paths (#7749) 2024-04-10 17:05:13 +02:00
amr_test.go feat(oidc): token exchange impersonation (#7516) 2024-03-20 10:18:46 +00:00
amr.go feat(oidc): token exchange impersonation (#7516) 2024-03-20 10:18:46 +00:00
auth_request_converter_v2.go merge main into next 2023-10-19 12:34:00 +02:00
auth_request_converter.go fix(oidc): define audience inside auth request instead of token creation (#7610) 2024-03-21 19:42:44 +02:00
auth_request_integration_test.go feat(oidc): optimize the userinfo endpoint (#7706) 2024-04-09 15:15:35 +02:00
auth_request.go fix(oidc): return bad request for base64 errors (#7730) 2024-04-09 08:42:59 +02:00
client_converter.go feat(oidc): token exchange impersonation (#7516) 2024-03-20 10:18:46 +00:00
client_credentials.go feat(crypto): use passwap for machine and app secrets (#7657) 2024-04-05 09:35:49 +00:00
client_integration_test.go fix(oidc): roles in userinfo for client credentials token (#7763) 2024-04-16 13:02:38 +00:00
client.go chore(deps): update all go deps (#7773) 2024-04-15 09:17:36 +00:00
device_auth.go feat(oidc): allow additional audience based on scope in device auth (#7685) 2024-04-03 09:06:21 +03:00
error_test.go fix: uniform oidc errors (#7237) 2024-01-18 07:10:49 +01:00
error.go fix(oidc): return bad request for base64 errors (#7730) 2024-04-09 08:42:59 +02:00
introspect.go fix(oidc): roles in userinfo for client credentials token (#7763) 2024-04-16 13:02:38 +00:00
jwt-profile.go fix: uniform oidc errors (#7237) 2024-01-18 07:10:49 +01:00
key_test.go chore(deps): update all go deps (#7773) 2024-04-15 09:17:36 +00:00
key.go chore(deps): update all go deps (#7773) 2024-04-15 09:17:36 +00:00
oidc_integration_test.go feat(oidc): optimize the userinfo endpoint (#7706) 2024-04-09 15:15:35 +02:00
op.go feat(crypto): use passwap for machine and app secrets (#7657) 2024-04-05 09:35:49 +00:00
server_test.go feat: restrict languages (#6931) 2023-12-05 11:12:01 +00:00
server.go feat(oidc): optimize the userinfo endpoint (#7706) 2024-04-09 15:15:35 +02:00
token_exchange_converter.go feat(oidc): token exchange impersonation (#7516) 2024-03-20 10:18:46 +00:00
token_exchange_integration_test.go fix(oidc): correctly return new refresh token on refresh token grant (#7707) 2024-04-04 15:58:40 +00:00
token_exchange.go fix(oidc): roles in userinfo for client credentials token (#7763) 2024-04-16 13:02:38 +00:00
userinfo_integration_test.go fix(oidc): roles in userinfo for client credentials token (#7763) 2024-04-16 13:02:38 +00:00
userinfo_test.go fix(oidc): roles in userinfo for client credentials token (#7763) 2024-04-16 13:02:38 +00:00
userinfo.go fix(oidc): roles in userinfo for client credentials token (#7763) 2024-04-16 13:02:38 +00:00