andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-29 18:42:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: native app links for passkeys (#12580)

Browse Source 
# Which Problems Are Solved

- Native iOS/Android passkeys need OS trust files on the ZITADEL domain;
without them, Associated Domains / App Links verification fails.
- Operators could not configure iOS Team ID + Bundle ID or Android
package name + SHA-256 fingerprints on OIDC apps.
- `/.well-known/apple-app-site-association` and
`/.well-known/assetlinks.json` were not served from application config.

# How the Problems Are Solved

- Add iOS/Android app-link fields on OIDC app create/update (Application
API v2 + Management), with validation.
- Persist and project those fields; query active app-link configs
instance-wide.
- Serve AASA (`webcredentials`) and Digital Asset Links
(`get_login_creds`) from well-known paths, with configurable
`Cache-Control` and fingerprint normalization at serve time.
- Console UI to edit the fields, with links to the well-known endpoints.
- Operator docs for configuration, endpoints, caching, and verification.

# Additional Changes

- Document on API fields that well-known responses may be HTTP-cached
and platform verifiers may delay propagation.
- Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`;
`0` → `no-store`).

# Additional Context

- Closes #12497
- Implemented and reviewed as stack:
  - #12531 API contract
  - #12532 storage wiring
  - #12536 well-known endpoints
  - #12537 console
  - #12547 docs

---------

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Livio Spring
2026-08-12 08:04:27 +02:00
committed by GitHub
co-authored by Cursor
parent 2bd42e8fc4
commit 318bfc36d7
68 changed files with 3227 additions and 467 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/command/project_application_oidc_test.go
+52 -13
View File
@@ -176,7 +176,10 @@ func TestAddOIDCApp(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
},
},
},
@@ -244,7 +247,10 @@ func TestAddOIDCApp(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
},
},
},
@@ -312,7 +318,10 @@ func TestAddOIDCApp(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
},
},
},
@@ -380,7 +389,10 @@ func TestAddOIDCApp(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
},
},
},
@@ -534,7 +546,10 @@ func TestCommandSide_AddOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion2,
"https://login.test.ch",
),
"",
"",
"",
nil),
),
),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "app1", "client1"),
@@ -643,7 +658,10 @@ func TestCommandSide_AddOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion2,
"https://login.test.ch",
),
"",
"",
"",
nil),
),
),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "client1"),
@@ -753,7 +771,10 @@ func TestCommandSide_AddOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion2,
"https://login.test.ch",
),
"",
"",
"",
nil),
),
),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "app1", "client1"),
@@ -1072,7 +1093,10 @@ func TestCommandSide_ChangeOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion2,
"https://login.test.ch",
),
"",
"",
"",
nil),
),
),
expectFilter(),
@@ -1147,7 +1171,10 @@ func TestCommandSide_ChangeOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion2,
"https://login.test.ch",
),
"",
"",
"",
nil),
),
),
expectFilter(),
@@ -1222,7 +1249,10 @@ func TestCommandSide_ChangeOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion1,
"",
),
"",
"",
"",
nil),
),
),
expectFilter(),
@@ -1316,7 +1346,10 @@ func TestCommandSide_ChangeOIDCApplication(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
),
),
expectFilter(),
@@ -1376,7 +1409,10 @@ func TestCommandSide_ChangeOIDCApplication(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
),
),
expectFilter(),
@@ -1531,7 +1567,10 @@ func TestCommandSide_ChangeOIDCApplicationSecret(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
),
),
expectPush(