andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-04 21:32:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(oidc): provide actor information in userinfo actions (#12566)

Browse Source 
# Which Problems Are Solved

Expose impersonating actor to `preAccessToken` and `preUserinfo`
actions.

# How the Problems Are Solved

Provide the `actor` information already present in the OIDC session
model of JWT token to the relevant actions. Both goja-based actions "v1"
and webhook based execution targets carry the actor information now.
Actor remains null in case of non-impersonated tokens. Actor may contain
nested actors to display a delegation chain of impersonators.

# Additional Changes

- dba6261c8ed0dfd00ffde6193910b1405b17432f: refactor `userinfoFlows` to
reduce complexity, add test coverage and solve a couple of potential
bugs.
- `getClientId` in actions was previously undocumented. Added to
documentation.
- A skill that reproduces manual testing using webhook.site or a local
sink.

# Additional Context

- Closes https://github.com/zitadel/zitadel/issues/12097

---------

Co-authored-by: Claude Sonnet 5 <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Co-authored-by: Wim Van Laer <[email protected]>
This commit is contained in:
Tim Möhlmann
2026-08-12 07:36:56 +00:00
committed by GitHub
co-authored by Claude Sonnet 5 Copilot Autofix powered by AI Wim Van Laer
parent 790244dd49
commit 6127b567e7
16 changed files with 1406 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/docs/content/apis/actions/objects.mdx
+13
View File
@@ -187,6 +187,19 @@ This object represents [the claims](../openidoauth/claims) which will be written
There could be additional fields depending on the settings of your [project](../../guides/manage/console/projects-overview#role-settings) and your [application](../../guides/manage/console/applications-overview#token-settings)
## token actor
This object represents the actor of a token, this is the party which obtained the token on behalf of the
subject through [token exchange](/guides/integrate/token-exchange#actor-token) or impersonation.
It corresponds to the [`act` claim](../openidoauth/claims) of the token and is `null` if the token has no actor.
- `userId` *string*
The id of the user acting on behalf of the subject
- `issuer` *string*
The issuer of the token the actor was authenticated with
- `actor` *token actor*
The previous actor in the delegation chain, `null` if there is none
## user grant list
This object represents a list of user grants (role assignments) stored in ZITADEL.