mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-15 10:25:11 +00:00
feat: native app links for passkeys (#12580)
# Which Problems Are Solved - Native iOS/Android passkeys need OS trust files on the ZITADEL domain; without them, Associated Domains / App Links verification fails. - Operators could not configure iOS Team ID + Bundle ID or Android package name + SHA-256 fingerprints on OIDC apps. - `/.well-known/apple-app-site-association` and `/.well-known/assetlinks.json` were not served from application config. # How the Problems Are Solved - Add iOS/Android app-link fields on OIDC app create/update (Application API v2 + Management), with validation. - Persist and project those fields; query active app-link configs instance-wide. - Serve AASA (`webcredentials`) and Digital Asset Links (`get_login_creds`) from well-known paths, with configurable `Cache-Control` and fingerprint normalization at serve time. - Console UI to edit the fields, with links to the well-known endpoints. - Operator docs for configuration, endpoints, caching, and verification. # Additional Changes - Document on API fields that well-known responses may be HTTP-cached and platform verifiers may delay propagation. - Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`; `0` → `no-store`). # Additional Context - Closes #12497 - Implemented and reviewed as stack: - #12531 API contract - #12532 storage wiring - #12536 well-known endpoints - #12537 console - #12547 docs --------- Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Livio Spring
Cursor
@@ -15,30 +15,36 @@ func CreateOIDCAppRequestToDomain(name, appID, projectID string, req *applicatio
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
iosTeamID, iosBundleID := iosAppLinkConfigToDomain(req.GetIos())
|
||||
androidPackageName, androidFingerprints := androidAppLinkConfigToDomain(req.GetAndroid())
|
||||
return &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{
|
||||
AggregateID: projectID,
|
||||
},
|
||||
AppID: appID,
|
||||
AppName: name,
|
||||
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
|
||||
RedirectUris: req.GetRedirectUris(),
|
||||
ResponseTypes: oidcResponseTypesToDomain(req.GetResponseTypes()),
|
||||
GrantTypes: oidcGrantTypesToDomain(req.GetGrantTypes()),
|
||||
ApplicationType: gu.Ptr(oidcApplicationTypeToDomain(req.GetApplicationType())),
|
||||
AuthMethodType: gu.Ptr(oidcAuthMethodTypeToDomain(req.GetAuthMethodType())),
|
||||
PostLogoutRedirectUris: req.GetPostLogoutRedirectUris(),
|
||||
DevMode: &req.DevelopmentMode,
|
||||
AccessTokenType: gu.Ptr(oidcTokenTypeToDomain(req.GetAccessTokenType())),
|
||||
AccessTokenRoleAssertion: gu.Ptr(req.GetAccessTokenRoleAssertion()),
|
||||
IDTokenRoleAssertion: gu.Ptr(req.GetIdTokenRoleAssertion()),
|
||||
IDTokenUserinfoAssertion: gu.Ptr(req.GetIdTokenUserinfoAssertion()),
|
||||
ClockSkew: gu.Ptr(req.GetClockSkew().AsDuration()),
|
||||
AdditionalOrigins: req.GetAdditionalOrigins(),
|
||||
SkipNativeAppSuccessPage: gu.Ptr(req.GetSkipNativeAppSuccessPage()),
|
||||
BackChannelLogoutURI: gu.Ptr(req.GetBackChannelLogoutUri()),
|
||||
LoginVersion: loginVersion,
|
||||
LoginBaseURI: loginBaseURI,
|
||||
AppID: appID,
|
||||
AppName: name,
|
||||
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
|
||||
RedirectUris: req.GetRedirectUris(),
|
||||
ResponseTypes: oidcResponseTypesToDomain(req.GetResponseTypes()),
|
||||
GrantTypes: oidcGrantTypesToDomain(req.GetGrantTypes()),
|
||||
ApplicationType: gu.Ptr(oidcApplicationTypeToDomain(req.GetApplicationType())),
|
||||
AuthMethodType: gu.Ptr(oidcAuthMethodTypeToDomain(req.GetAuthMethodType())),
|
||||
PostLogoutRedirectUris: req.GetPostLogoutRedirectUris(),
|
||||
DevMode: &req.DevelopmentMode,
|
||||
AccessTokenType: gu.Ptr(oidcTokenTypeToDomain(req.GetAccessTokenType())),
|
||||
AccessTokenRoleAssertion: gu.Ptr(req.GetAccessTokenRoleAssertion()),
|
||||
IDTokenRoleAssertion: gu.Ptr(req.GetIdTokenRoleAssertion()),
|
||||
IDTokenUserinfoAssertion: gu.Ptr(req.GetIdTokenUserinfoAssertion()),
|
||||
ClockSkew: gu.Ptr(req.GetClockSkew().AsDuration()),
|
||||
AdditionalOrigins: req.GetAdditionalOrigins(),
|
||||
SkipNativeAppSuccessPage: gu.Ptr(req.GetSkipNativeAppSuccessPage()),
|
||||
BackChannelLogoutURI: gu.Ptr(req.GetBackChannelLogoutUri()),
|
||||
LoginVersion: loginVersion,
|
||||
LoginBaseURI: loginBaseURI,
|
||||
IOSTeamID: iosTeamID,
|
||||
IOSBundleID: iosBundleID,
|
||||
AndroidPackageName: androidPackageName,
|
||||
AndroidSHA256CertFingerprints: androidFingerprints,
|
||||
}, nil
|
||||
}
|
||||
|
||||
@@ -47,28 +53,35 @@ func UpdateOIDCAppConfigRequestToDomain(appID, projectID string, app *applicatio
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// nested messages: omit = no change; present (incl. empty) = set/clear
|
||||
iosTeamID, iosBundleID := iosAppLinkConfigToDomain(app.Ios)
|
||||
androidPackageName, androidFingerprints := androidAppLinkConfigToDomain(app.Android)
|
||||
return &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{
|
||||
AggregateID: projectID,
|
||||
},
|
||||
AppID: appID,
|
||||
RedirectUris: app.RedirectUris,
|
||||
ResponseTypes: oidcResponseTypesToDomain(app.ResponseTypes),
|
||||
GrantTypes: oidcGrantTypesToDomain(app.GrantTypes),
|
||||
ApplicationType: oidcApplicationTypeToDomainPtr(app.ApplicationType),
|
||||
AuthMethodType: oidcAuthMethodTypeToDomainPtr(app.AuthMethodType),
|
||||
PostLogoutRedirectUris: app.PostLogoutRedirectUris,
|
||||
DevMode: app.DevelopmentMode,
|
||||
AccessTokenType: oidcTokenTypeToDomainPtr(app.AccessTokenType),
|
||||
AccessTokenRoleAssertion: app.AccessTokenRoleAssertion,
|
||||
IDTokenRoleAssertion: app.IdTokenRoleAssertion,
|
||||
IDTokenUserinfoAssertion: app.IdTokenUserinfoAssertion,
|
||||
ClockSkew: gu.Ptr(app.GetClockSkew().AsDuration()),
|
||||
AdditionalOrigins: app.AdditionalOrigins,
|
||||
SkipNativeAppSuccessPage: app.SkipNativeAppSuccessPage,
|
||||
BackChannelLogoutURI: app.BackChannelLogoutUri,
|
||||
LoginVersion: loginVersion,
|
||||
LoginBaseURI: loginBaseURI,
|
||||
AppID: appID,
|
||||
RedirectUris: app.RedirectUris,
|
||||
ResponseTypes: oidcResponseTypesToDomain(app.ResponseTypes),
|
||||
GrantTypes: oidcGrantTypesToDomain(app.GrantTypes),
|
||||
ApplicationType: oidcApplicationTypeToDomainPtr(app.ApplicationType),
|
||||
AuthMethodType: oidcAuthMethodTypeToDomainPtr(app.AuthMethodType),
|
||||
PostLogoutRedirectUris: app.PostLogoutRedirectUris,
|
||||
DevMode: app.DevelopmentMode,
|
||||
AccessTokenType: oidcTokenTypeToDomainPtr(app.AccessTokenType),
|
||||
AccessTokenRoleAssertion: app.AccessTokenRoleAssertion,
|
||||
IDTokenRoleAssertion: app.IdTokenRoleAssertion,
|
||||
IDTokenUserinfoAssertion: app.IdTokenUserinfoAssertion,
|
||||
ClockSkew: gu.Ptr(app.GetClockSkew().AsDuration()),
|
||||
AdditionalOrigins: app.AdditionalOrigins,
|
||||
SkipNativeAppSuccessPage: app.SkipNativeAppSuccessPage,
|
||||
BackChannelLogoutURI: app.BackChannelLogoutUri,
|
||||
LoginVersion: loginVersion,
|
||||
LoginBaseURI: loginBaseURI,
|
||||
IOSTeamID: iosTeamID,
|
||||
IOSBundleID: iosBundleID,
|
||||
AndroidPackageName: androidPackageName,
|
||||
AndroidSHA256CertFingerprints: androidFingerprints,
|
||||
}, nil
|
||||
}
|
||||
|
||||
@@ -213,10 +226,50 @@ func appOIDCConfigToPb(oidcApp *query.OIDCApp) *application.Application_OidcConf
|
||||
SkipNativeAppSuccessPage: oidcApp.SkipNativeAppSuccessPage,
|
||||
BackChannelLogoutUri: oidcApp.BackChannelLogoutURI,
|
||||
LoginVersion: loginVersionToPb(oidcApp.LoginVersion, oidcApp.LoginBaseURI),
|
||||
Ios: iosAppLinkConfigToPb(oidcApp.IOSTeamID, oidcApp.IOSBundleID),
|
||||
Android: androidAppLinkConfigToPb(oidcApp.AndroidPackageName, oidcApp.AndroidSHA256CertFingerprints),
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func iosAppLinkConfigToDomain(cfg *application.IOSAppLinkConfig) (teamID, bundleID *string) {
|
||||
if cfg == nil {
|
||||
return nil, nil
|
||||
}
|
||||
return gu.Ptr(cfg.GetTeamId()), gu.Ptr(cfg.GetBundleId())
|
||||
}
|
||||
|
||||
func androidAppLinkConfigToDomain(cfg *application.AndroidAppLinkConfig) (packageName *string, fingerprints []string) {
|
||||
if cfg == nil {
|
||||
return nil, nil
|
||||
}
|
||||
fps := cfg.GetSha256CertFingerprints()
|
||||
if fps == nil {
|
||||
fps = []string{}
|
||||
}
|
||||
return gu.Ptr(cfg.GetPackageName()), fps
|
||||
}
|
||||
|
||||
func iosAppLinkConfigToPb(teamID, bundleID string) *application.IOSAppLinkConfig {
|
||||
if teamID == "" && bundleID == "" {
|
||||
return nil
|
||||
}
|
||||
return &application.IOSAppLinkConfig{
|
||||
TeamId: teamID,
|
||||
BundleId: bundleID,
|
||||
}
|
||||
}
|
||||
|
||||
func androidAppLinkConfigToPb(packageName string, fingerprints []string) *application.AndroidAppLinkConfig {
|
||||
if packageName == "" && len(fingerprints) == 0 {
|
||||
return nil
|
||||
}
|
||||
return &application.AndroidAppLinkConfig{
|
||||
PackageName: packageName,
|
||||
Sha256CertFingerprints: fingerprints,
|
||||
}
|
||||
}
|
||||
|
||||
func oidcResponseTypesFromModel(responseTypes []domain.OIDCResponseType) []application.OIDCResponseType {
|
||||
oidcResponseTypes := make([]application.OIDCResponseType, len(responseTypes))
|
||||
for i, responseType := range responseTypes {
|
||||
|
||||
Reference in New Issue
Block a user