andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-12 00:55:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: native app links for passkeys (#12580)

Browse Source 
# Which Problems Are Solved

- Native iOS/Android passkeys need OS trust files on the ZITADEL domain;
without them, Associated Domains / App Links verification fails.
- Operators could not configure iOS Team ID + Bundle ID or Android
package name + SHA-256 fingerprints on OIDC apps.
- `/.well-known/apple-app-site-association` and
`/.well-known/assetlinks.json` were not served from application config.

# How the Problems Are Solved

- Add iOS/Android app-link fields on OIDC app create/update (Application
API v2 + Management), with validation.
- Persist and project those fields; query active app-link configs
instance-wide.
- Serve AASA (`webcredentials`) and Digital Asset Links
(`get_login_creds`) from well-known paths, with configurable
`Cache-Control` and fingerprint normalization at serve time.
- Console UI to edit the fields, with links to the well-known endpoints.
- Operator docs for configuration, endpoints, caching, and verification.

# Additional Changes

- Document on API fields that well-known responses may be HTTP-cached
and platform verifiers may delay propagation.
- Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`;
`0` → `no-store`).

# Additional Context

- Closes #12497
- Implemented and reviewed as stack:
  - #12531 API contract
  - #12532 storage wiring
  - #12536 well-known endpoints
  - #12537 console
  - #12547 docs

---------

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Livio Spring
2026-08-12 08:04:27 +02:00
committed by GitHub
co-authored by Cursor
parent 2bd42e8fc4
commit 318bfc36d7
68 changed files with 3227 additions and 467 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/query/app_test.go
+96
View File
@@ -51,6 +51,10 @@ var (
` projections.apps7_oidc_configs.back_channel_logout_uri,` +
` projections.apps7_oidc_configs.login_version,` +
` projections.apps7_oidc_configs.login_base_uri,` +
` projections.apps7_oidc_configs.ios_team_id,` +
` projections.apps7_oidc_configs.ios_bundle_id,` +
` projections.apps7_oidc_configs.android_package_name,` +
` projections.apps7_oidc_configs.android_sha256_cert_fingerprints,` +
//saml config
` projections.apps7_saml_configs.app_id,` +
` projections.apps7_saml_configs.entity_id,` +
@@ -99,6 +103,10 @@ var (
` projections.apps7_oidc_configs.back_channel_logout_uri,` +
` projections.apps7_oidc_configs.login_version,` +
` projections.apps7_oidc_configs.login_base_uri,` +
` projections.apps7_oidc_configs.ios_team_id,` +
` projections.apps7_oidc_configs.ios_bundle_id,` +
` projections.apps7_oidc_configs.android_package_name,` +
` projections.apps7_oidc_configs.android_sha256_cert_fingerprints,` +
//saml config
` projections.apps7_saml_configs.app_id,` +
` projections.apps7_saml_configs.entity_id,` +
@@ -172,6 +180,10 @@ var (
"back_channel_logout_uri",
"login_version",
"login_base_uri",
"ios_team_id",
"ios_bundle_id",
"android_package_name",
"android_sha256_cert_fingerprints",
//saml config
"app_id",
"entity_id",
@@ -248,6 +260,10 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -319,6 +335,10 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -393,6 +413,10 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
"app-id",
"https://test.com/saml/metadata",
@@ -469,6 +493,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -563,6 +591,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -657,6 +689,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -751,6 +787,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -845,6 +885,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -939,6 +983,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1033,6 +1081,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersion2,
"https://login.ch/",
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1075,6 +1127,10 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1117,6 +1173,10 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
"saml-app-id",
"https://test.com/saml/metadata",
@@ -1302,6 +1362,10 @@ func Test_AppPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1367,6 +1431,10 @@ func Test_AppPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1437,6 +1505,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1526,6 +1598,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1615,6 +1691,10 @@ func Test_AppPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
"app-id",
"https://test.com/saml/metadata",
@@ -1688,6 +1768,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1777,6 +1861,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1866,6 +1954,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1955,6 +2047,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,