mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-15 02:15:14 +00:00
feat: native app links for passkeys (#12580)
# Which Problems Are Solved - Native iOS/Android passkeys need OS trust files on the ZITADEL domain; without them, Associated Domains / App Links verification fails. - Operators could not configure iOS Team ID + Bundle ID or Android package name + SHA-256 fingerprints on OIDC apps. - `/.well-known/apple-app-site-association` and `/.well-known/assetlinks.json` were not served from application config. # How the Problems Are Solved - Add iOS/Android app-link fields on OIDC app create/update (Application API v2 + Management), with validation. - Persist and project those fields; query active app-link configs instance-wide. - Serve AASA (`webcredentials`) and Digital Asset Links (`get_login_creds`) from well-known paths, with configurable `Cache-Control` and fingerprint normalization at serve time. - Console UI to edit the fields, with links to the well-known endpoints. - Operator docs for configuration, endpoints, caching, and verification. # Additional Changes - Document on API fields that well-known responses may be HTTP-cached and platform verifiers may delay propagation. - Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`; `0` → `no-store`). # Additional Context - Closes #12497 - Implemented and reviewed as stack: - #12531 API contract - #12532 storage wiring - #12536 well-known endpoints - #12537 console - #12547 docs --------- Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Livio Spring
Cursor
@@ -66,29 +66,41 @@ func TestCreateOIDCAppRequestToDomain(t *testing.T) {
|
||||
LoginVersion: &application.LoginVersion{Version: &application.LoginVersion_LoginV2{LoginV2: &application.LoginV2{
|
||||
BaseUri: gu.Ptr("https://login"),
|
||||
}}},
|
||||
Ios: &application.IOSAppLinkConfig{
|
||||
TeamId: "TEAMID",
|
||||
BundleId: "com.example.app",
|
||||
},
|
||||
Android: &application.AndroidAppLinkConfig{
|
||||
PackageName: "com.example.app",
|
||||
Sha256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
},
|
||||
expectedModel: &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{AggregateID: "project1"},
|
||||
AppName: "all fields set",
|
||||
AppID: "app1",
|
||||
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
|
||||
RedirectUris: []string{"https://redirect"},
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
ApplicationType: gu.Ptr(domain.OIDCApplicationTypeWeb),
|
||||
AuthMethodType: gu.Ptr(domain.OIDCAuthMethodTypeBasic),
|
||||
PostLogoutRedirectUris: []string{"https://logout"},
|
||||
DevMode: gu.Ptr(true),
|
||||
AccessTokenType: gu.Ptr(domain.OIDCTokenTypeBearer),
|
||||
AccessTokenRoleAssertion: gu.Ptr(true),
|
||||
IDTokenRoleAssertion: gu.Ptr(true),
|
||||
IDTokenUserinfoAssertion: gu.Ptr(true),
|
||||
ClockSkew: gu.Ptr(5 * time.Second),
|
||||
AdditionalOrigins: []string{"https://origin"},
|
||||
SkipNativeAppSuccessPage: gu.Ptr(true),
|
||||
BackChannelLogoutURI: gu.Ptr("https://backchannel"),
|
||||
LoginVersion: gu.Ptr(domain.LoginVersion2),
|
||||
LoginBaseURI: gu.Ptr("https://login"),
|
||||
ObjectRoot: models.ObjectRoot{AggregateID: "project1"},
|
||||
AppName: "all fields set",
|
||||
AppID: "app1",
|
||||
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
|
||||
RedirectUris: []string{"https://redirect"},
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
ApplicationType: gu.Ptr(domain.OIDCApplicationTypeWeb),
|
||||
AuthMethodType: gu.Ptr(domain.OIDCAuthMethodTypeBasic),
|
||||
PostLogoutRedirectUris: []string{"https://logout"},
|
||||
DevMode: gu.Ptr(true),
|
||||
AccessTokenType: gu.Ptr(domain.OIDCTokenTypeBearer),
|
||||
AccessTokenRoleAssertion: gu.Ptr(true),
|
||||
IDTokenRoleAssertion: gu.Ptr(true),
|
||||
IDTokenUserinfoAssertion: gu.Ptr(true),
|
||||
ClockSkew: gu.Ptr(5 * time.Second),
|
||||
AdditionalOrigins: []string{"https://origin"},
|
||||
SkipNativeAppSuccessPage: gu.Ptr(true),
|
||||
BackChannelLogoutURI: gu.Ptr("https://backchannel"),
|
||||
LoginVersion: gu.Ptr(domain.LoginVersion2),
|
||||
LoginBaseURI: gu.Ptr("https://login"),
|
||||
IOSTeamID: gu.Ptr("TEAMID"),
|
||||
IOSBundleID: gu.Ptr("com.example.app"),
|
||||
AndroidPackageName: gu.Ptr("com.example.app"),
|
||||
AndroidSHA256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -182,6 +194,71 @@ func TestUpdateOIDCAppConfigRequestToDomain(t *testing.T) {
|
||||
LoginBaseURI: gu.Ptr("https://login"),
|
||||
},
|
||||
},
|
||||
{
|
||||
testName: "omit app links leaves nil",
|
||||
appID: "app1",
|
||||
projectID: "proj1",
|
||||
req: &application.UpdateOIDCApplicationConfigurationRequest{},
|
||||
expectedModel: &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{AggregateID: "proj1"},
|
||||
AppID: "app1",
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
ClockSkew: gu.Ptr(time.Duration(0)),
|
||||
LoginVersion: gu.Ptr(domain.LoginVersionUnspecified),
|
||||
LoginBaseURI: gu.Ptr(""),
|
||||
},
|
||||
},
|
||||
{
|
||||
testName: "set app links",
|
||||
appID: "app1",
|
||||
projectID: "proj1",
|
||||
req: &application.UpdateOIDCApplicationConfigurationRequest{
|
||||
Ios: &application.IOSAppLinkConfig{
|
||||
TeamId: "TEAMID",
|
||||
BundleId: "com.example.app",
|
||||
},
|
||||
Android: &application.AndroidAppLinkConfig{
|
||||
PackageName: "com.example.app",
|
||||
Sha256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
},
|
||||
expectedModel: &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{AggregateID: "proj1"},
|
||||
AppID: "app1",
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
ClockSkew: gu.Ptr(time.Duration(0)),
|
||||
LoginVersion: gu.Ptr(domain.LoginVersionUnspecified),
|
||||
LoginBaseURI: gu.Ptr(""),
|
||||
IOSTeamID: gu.Ptr("TEAMID"),
|
||||
IOSBundleID: gu.Ptr("com.example.app"),
|
||||
AndroidPackageName: gu.Ptr("com.example.app"),
|
||||
AndroidSHA256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
},
|
||||
{
|
||||
testName: "clear app links with empty messages",
|
||||
appID: "app1",
|
||||
projectID: "proj1",
|
||||
req: &application.UpdateOIDCApplicationConfigurationRequest{
|
||||
Ios: &application.IOSAppLinkConfig{},
|
||||
Android: &application.AndroidAppLinkConfig{},
|
||||
},
|
||||
expectedModel: &domain.OIDCApp{
|
||||
ObjectRoot: models.ObjectRoot{AggregateID: "proj1"},
|
||||
AppID: "app1",
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
ClockSkew: gu.Ptr(time.Duration(0)),
|
||||
LoginVersion: gu.Ptr(domain.LoginVersionUnspecified),
|
||||
LoginBaseURI: gu.Ptr(""),
|
||||
IOSTeamID: gu.Ptr(""),
|
||||
IOSBundleID: gu.Ptr(""),
|
||||
AndroidPackageName: gu.Ptr(""),
|
||||
AndroidSHA256CertFingerprints: []string{},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range tt {
|
||||
@@ -453,26 +530,30 @@ func TestAppOIDCConfigToPb(t *testing.T) {
|
||||
{
|
||||
name: "full config",
|
||||
input: &query.OIDCApp{
|
||||
RedirectURIs: []string{"https://example.com/callback"},
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
AppType: domain.OIDCApplicationTypeWeb,
|
||||
ClientID: "client123",
|
||||
AuthMethodType: domain.OIDCAuthMethodTypeBasic,
|
||||
PostLogoutRedirectURIs: []string{"https://example.com/logout"},
|
||||
ComplianceProblems: []string{"problem1", "problem2"},
|
||||
IsDevMode: true,
|
||||
AccessTokenType: domain.OIDCTokenTypeBearer,
|
||||
AssertAccessTokenRole: true,
|
||||
AssertIDTokenRole: true,
|
||||
AssertIDTokenUserinfo: true,
|
||||
ClockSkew: 5 * time.Second,
|
||||
AdditionalOrigins: []string{"https://app.example.com"},
|
||||
AllowedOrigins: []string{"https://allowed.example.com"},
|
||||
SkipNativeAppSuccessPage: true,
|
||||
BackChannelLogoutURI: "https://example.com/backchannel",
|
||||
LoginVersion: domain.LoginVersion2,
|
||||
LoginBaseURI: gu.Ptr("https://login.example.com"),
|
||||
RedirectURIs: []string{"https://example.com/callback"},
|
||||
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
|
||||
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
|
||||
AppType: domain.OIDCApplicationTypeWeb,
|
||||
ClientID: "client123",
|
||||
AuthMethodType: domain.OIDCAuthMethodTypeBasic,
|
||||
PostLogoutRedirectURIs: []string{"https://example.com/logout"},
|
||||
ComplianceProblems: []string{"problem1", "problem2"},
|
||||
IsDevMode: true,
|
||||
AccessTokenType: domain.OIDCTokenTypeBearer,
|
||||
AssertAccessTokenRole: true,
|
||||
AssertIDTokenRole: true,
|
||||
AssertIDTokenUserinfo: true,
|
||||
ClockSkew: 5 * time.Second,
|
||||
AdditionalOrigins: []string{"https://app.example.com"},
|
||||
AllowedOrigins: []string{"https://allowed.example.com"},
|
||||
SkipNativeAppSuccessPage: true,
|
||||
BackChannelLogoutURI: "https://example.com/backchannel",
|
||||
LoginVersion: domain.LoginVersion2,
|
||||
LoginBaseURI: gu.Ptr("https://login.example.com"),
|
||||
IOSTeamID: "TEAMID",
|
||||
IOSBundleID: "com.example.app",
|
||||
AndroidPackageName: "com.example.app",
|
||||
AndroidSHA256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
expected: &application.Application_OidcConfiguration{
|
||||
OidcConfiguration: &application.OIDCConfiguration{
|
||||
@@ -506,6 +587,14 @@ func TestAppOIDCConfigToPb(t *testing.T) {
|
||||
},
|
||||
},
|
||||
},
|
||||
Ios: &application.IOSAppLinkConfig{
|
||||
TeamId: "TEAMID",
|
||||
BundleId: "com.example.app",
|
||||
},
|
||||
Android: &application.AndroidAppLinkConfig{
|
||||
PackageName: "com.example.app",
|
||||
Sha256CertFingerprints: []string{"AA:BB:CC"},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
Reference in New Issue
Block a user