andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-01 11:52:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(oidc): provide actor information in userinfo actions (#12566)

Browse Source 
# Which Problems Are Solved

Expose impersonating actor to `preAccessToken` and `preUserinfo`
actions.

# How the Problems Are Solved

Provide the `actor` information already present in the OIDC session
model of JWT token to the relevant actions. Both goja-based actions "v1"
and webhook based execution targets carry the actor information now.
Actor remains null in case of non-impersonated tokens. Actor may contain
nested actors to display a delegation chain of impersonators.

# Additional Changes

- dba6261c8ed0dfd00ffde6193910b1405b17432f: refactor `userinfoFlows` to
reduce complexity, add test coverage and solve a couple of potential
bugs.
- `getClientId` in actions was previously undocumented. Added to
documentation.
- A skill that reproduces manual testing using webhook.site or a local
sink.

# Additional Context

- Closes https://github.com/zitadel/zitadel/issues/12097

---------

Co-authored-by: Claude Sonnet 5 <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Co-authored-by: Wim Van Laer <[email protected]>
This commit is contained in:
Tim Möhlmann
2026-08-12 07:36:56 +00:00
committed by GitHub
co-authored by Claude Sonnet 5 Copilot Autofix powered by AI Wim Van Laer
parent 790244dd49
commit 6127b567e7
16 changed files with 1406 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/docs/content/apis/actions/complement-token.mdx
+10
View File
@@ -25,6 +25,11 @@ The trigger is represented by the following Ids in the API: `4`
- `grants` [*UserGrantList*](./objects#user-grant-list)
- `org`
- `getMetadata()` [*metadataResult*](./objects#metadata-result)
- `application`
- `getClientId()` *string*
The client id of the application the token was requested for
- `actor` [*token actor*](./objects#token-actor)
The party which obtained the token on behalf of the user, `null` unless the token was obtained through token exchange or impersonation
- `api`
The second parameter contains the following fields:
- `v1`
@@ -59,6 +64,11 @@ The trigger is represented by the following Ids in the API: `5`
- `grants` [*UserGrantList*](./objects#user-grant-list)
- `org`
- `getMetadata()` [*metadataResult*](./objects#metadata-result)
- `application`
- `getClientId()` *string*
The client id of the application the token was requested for
- `actor` [*token actor*](./objects#token-actor)
The party which obtained the token on behalf of the user, `null` unless the token was obtained through token exchange or impersonation
- `api`
The second parameter contains the following fields:
- `v1`