mirror of
https://github.com/zitadel/zitadel.git
synced 2025-12-25 04:37:10 +00:00
b8bff3cdea
# Which Problems Are Solved #9861 added a `urn:zitadel:iam:org:projects:roles` claims to include all roles from all requested roles. The intention was to return them on the userinfo endpoint. But since the claims might also be returned in the id and access tokens, they can grow big quite fast and break the size limits for headers. # How the Problems Are Solved This PR revert the feature. The information for roles of other projects is already available as a dedicated claim (for each project): ```json "urn:zitadel:iam:org:project:328813096124547391:roles": { "r2": { "306639557921669515": "zitadel.localhost" }, "r3": { "306639557921669515": "zitadel.localhost" }, "role": { "306639557921669515": "zitadel.localhost" } }, "urn:zitadel:iam:org:project:341406882914631999:roles": { "role": { "306639557921669515": "zitadel.localhost", "328237605990695334": "aa.localhost" }, "test": { "306639557921669515": "zitadel.localhost", "328237605990695334": "aa.localhost" } }, "urn:zitadel:iam:org:project:roles": { "r2": { "306639557921669515": "zitadel.localhost" }, "r3": { "306639557921669515": "zitadel.localhost" }, "role": { "306639557921669515": "zitadel.localhost" } } ``` # Additional Changes None # Additional Context - relates to #9861 - noted issues in production - requires backport to v4.x
81 lines
1.9 KiB
Go
81 lines
1.9 KiB
Go
package domain
|
|
|
|
const (
|
|
OrgDomainPrimaryScope = "urn:zitadel:iam:org:domain:primary:"
|
|
OrgIDScope = "urn:zitadel:iam:org:id:"
|
|
OrgRoleIDScope = "urn:zitadel:iam:org:roles:id:"
|
|
OrgDomainPrimaryClaim = "urn:zitadel:iam:org:domain:primary"
|
|
OrgIDClaim = "urn:zitadel:iam:org:id"
|
|
ProjectIDScope = "urn:zitadel:iam:org:project:id:"
|
|
ProjectIDScopeZITADEL = "zitadel"
|
|
AudSuffix = ":aud"
|
|
ProjectScopeZITADEL = ProjectIDScope + ProjectIDScopeZITADEL + AudSuffix
|
|
SelectIDPScope = "urn:zitadel:iam:org:idp:id:"
|
|
)
|
|
|
|
// TODO: Change AuthRequest to interface and let oidcauthreqesut implement it
|
|
type Request interface {
|
|
Type() AuthRequestType
|
|
IsValid() bool
|
|
}
|
|
|
|
type AuthRequestType int32
|
|
|
|
const (
|
|
AuthRequestTypeOIDC AuthRequestType = iota
|
|
AuthRequestTypeSAML
|
|
AuthRequestTypeDevice
|
|
)
|
|
|
|
type AuthRequestOIDC struct {
|
|
Scopes []string
|
|
ResponseType OIDCResponseType
|
|
ResponseMode OIDCResponseMode
|
|
Nonce string
|
|
CodeChallenge *OIDCCodeChallenge
|
|
}
|
|
|
|
func (a *AuthRequestOIDC) Type() AuthRequestType {
|
|
return AuthRequestTypeOIDC
|
|
}
|
|
|
|
func (a *AuthRequestOIDC) IsValid() bool {
|
|
return len(a.Scopes) > 0 &&
|
|
a.CodeChallenge == nil || a.CodeChallenge != nil && a.CodeChallenge.IsValid()
|
|
}
|
|
|
|
type AuthRequestSAML struct {
|
|
ID string
|
|
BindingType string
|
|
Code string
|
|
Issuer string
|
|
IssuerName string
|
|
Destination string
|
|
}
|
|
|
|
func (a *AuthRequestSAML) Type() AuthRequestType {
|
|
return AuthRequestTypeSAML
|
|
}
|
|
|
|
func (a *AuthRequestSAML) IsValid() bool {
|
|
return true
|
|
}
|
|
|
|
type AuthRequestDevice struct {
|
|
ClientID string
|
|
DeviceCode string
|
|
UserCode string
|
|
Scopes []string
|
|
Audience []string
|
|
AppName string
|
|
ProjectName string
|
|
}
|
|
|
|
func (*AuthRequestDevice) Type() AuthRequestType {
|
|
return AuthRequestTypeDevice
|
|
}
|
|
|
|
func (a *AuthRequestDevice) IsValid() bool {
|
|
return a.DeviceCode != "" && a.UserCode != ""
|
|
}
|