mirror of
https://github.com/zitadel/zitadel.git
synced 2025-12-24 12:29:11 +00:00
295584648d
# Which Problems Are Solved The /userinfo endpoint only returns roles for the current project, even if the access token includes multiple project aud scopes. This prevents clients from retrieving all user roles across multiple projects, making multi-project access control ineffective. # How the Problems Are Solved Modified the /userinfo handler logic to resolve roles across all valid project audience scopes provided in the token, not just the current project. Ensured that if **urn:zitadel:iam:org:projects:roles is in the scopes**, roles from all declared project audiences are collected and included in the response in **urn:zitadel:iam:org:projects:roles claim**. # Additional Changes # Additional Context This change enables service-to-service authorization workflows and SPA role resolution across multiple project contexts with a single token. - Closes #9831 --------- Co-authored-by: Masum Patel <patelmasum98@gmail.com> Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>