From 5dcce9abdb85ac98e4cd0f5f3888770628609319 Mon Sep 17 00:00:00 2001 From: Gayathri Vijayan <66356931+grvijayan@users.noreply.github.com> Date: Fri, 3 Jul 2026 14:52:26 +0200 Subject: [PATCH] feat: add api definition to update Zitadel IdP (#12371) # Which Problems Are Solved Enabling updates on the Zitadel Identity Provider # How the Problems Are Solved This PR adds API definitions to update Zitadel provider at instance and organization levels. # Additional Changes N/A # Additional Context - Related to https://github.com/zitadel/zitadel/issues/11922 - Follow-up for PRs: - https://github.com/zitadel/zitadel/pull/12018 - https://github.com/zitadel/zitadel/pull/12020 - https://github.com/zitadel/zitadel/pull/12055 - https://github.com/zitadel/zitadel/pull/12056 --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- proto/zitadel/admin.proto | 71 ++++++++++++++++++++++++++++++ proto/zitadel/management.proto | 79 ++++++++++++++++++++++++++++++++++ 2 files changed, 150 insertions(+) diff --git a/proto/zitadel/admin.proto b/proto/zitadel/admin.proto index 0442ee8f5..736461470 100644 --- a/proto/zitadel/admin.proto +++ b/proto/zitadel/admin.proto @@ -2271,6 +2271,24 @@ service AdminService { }; } + // Change an existing Zitadel identity provider on the instance + rpc UpdateZitadelProvider(UpdateZitadelProviderRequest) returns (UpdateZitadelProviderResponse) { + option (google.api.http) = { + put: "/idps/zitadel/{id}" + body: "*" + }; + + option (zitadel.v1.auth_option) = { + permission: "iam.idp.write" + }; + + option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = { + tags: "Identity Providers"; + summary: "Update Zitadel Identity Provider"; + description: ""; + }; + } + // Remove an identity provider // Will remove all linked providers of this configuration on the users rpc DeleteProvider(DeleteProviderRequest) returns (DeleteProviderResponse) { @@ -7362,6 +7380,59 @@ message AddZitadelProviderResponse { string id = 2; } +message UpdateZitadelProviderRequest { + string id = 1 [ + (validate.rules).string = {min_len: 1, max_len: 200}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"69629023906488334\""; + } + ]; + string name = 2 [ + (validate.rules).string = {min_len: 1, max_len: 200}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"Zitadel\""; + } + ]; + string issuer = 3 [ + (validate.rules).string = {min_len: 1, max_len: 200}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"https://zitadel.example.com/\""; + description: "the OIDC issuer of the identity provider"; + } + ]; + string client_id = 4 [ + (validate.rules).string = {min_len: 1, max_len: 200}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"client-id\""; + description: "client id generated by the identity provider"; + } + ]; + // client_secret will only be updated if provided + string client_secret = 5 [ + (validate.rules).string = {max_len: 1000}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"secret\""; + description: "client secret will only be updated if provided"; + } + ]; + repeated string scopes = 6 [ + (validate.rules).repeated = {max_items: 20, items: {string: {min_len: 1, max_len: 100}}}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "[\"openid\", \"profile\", \"email\"]"; + description: "the scopes requested by Zitadel during the request on the identity provider"; + } + ]; + zitadel.idp.v1.Options provider_options = 7; + + // Optionally specify the details (organization_id, organization_domain) related to instance roles. + // It is used to determine if a user should be assigned instance administrator roles after authenticating with the provider. + repeated zitadel.idp.v1.InstanceRolesInfo instance_roles_info = 8 [(validate.rules).repeated = {max_items: 20}]; +} + +message UpdateZitadelProviderResponse { + zitadel.v1.ObjectDetails details = 1; +} + message DeleteProviderRequest { string id = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; } diff --git a/proto/zitadel/management.proto b/proto/zitadel/management.proto index ef35288b5..6ef4603fa 100644 --- a/proto/zitadel/management.proto +++ b/proto/zitadel/management.proto @@ -8189,6 +8189,33 @@ service ManagementService { }; } + // Change an existing Zitadel identity provider in the organization + rpc UpdateZitadelProvider(UpdateZitadelProviderRequest) returns (UpdateZitadelProviderResponse) { + option (google.api.http) = { + put: "/idps/zitadel/{id}" + body: "*" + }; + + option (zitadel.v1.auth_option) = { + permission: "org.idp.write" + }; + + option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = { + tags: "Identity Providers"; + summary: "Update Zitadel Identity Provider"; + description: ""; + parameters: { + headers: { + name: "x-zitadel-orgid"; + description: "The default is always the organization of the requesting user. If you like to get/set a result of another organization include the header. Make sure the user has permission to access the requested data."; + type: STRING, + required: false; + }; + }; + }; + } + + // Remove an identity provider // Will remove all linked providers of this configuration on the users rpc DeleteProvider(DeleteProviderRequest) returns (DeleteProviderResponse) { @@ -14111,6 +14138,58 @@ message AddZitadelProviderResponse { string id = 2; } +message UpdateZitadelProviderRequest { + string id = 1 [ + (validate.rules).string = {min_len: 1, max_len: 200}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"69629023906488334\""; + } + ]; + string name = 2 [ + (validate.rules).string = {min_len: 1, max_len: 200}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"Zitadel\""; + } + ]; + string issuer = 3 [ + (validate.rules).string = {min_len: 1, max_len: 200}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"https://zitadel.example.com/\""; + description: "the OIDC issuer of the identity provider"; + } + ]; + string client_id = 4 [ + (validate.rules).string = {min_len: 1, max_len: 200}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"client-id\""; + description: "client id generated by the identity provider"; + } + ]; + // client_secret will only be updated if provided + string client_secret = 5 [ + (validate.rules).string = {max_len: 1000}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "\"secret\""; + description: "client secret will only be updated if provided"; + } + ]; + repeated string scopes = 6 [ + (validate.rules).repeated = {max_items: 20, items: {string: {min_len: 1, max_len: 100}}}, + (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { + example: "[\"openid\", \"profile\", \"email\"]"; + description: "the scopes requested by Zitadel during the request on the identity provider"; + } + ]; + zitadel.idp.v1.Options provider_options = 7; + + // Optionally specify the details (organization_id, organization_domain) related to instance roles. + // It is used to determine if a user should be assigned instance administrator roles after authenticating with the provider. + repeated zitadel.idp.v1.InstanceRolesInfo instance_roles_info = 8 [(validate.rules).repeated = {max_items: 20}]; +} + +message UpdateZitadelProviderResponse { + zitadel.v1.ObjectDetails details = 1; +} message DeleteProviderRequest { string id = 1 [(validate.rules).string = {min_len: 1, max_len: 200}];