andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-18 05:52:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add option to use x.509 certificate system-api-user tokens (#11876)

Browse Source 
# Which Problems Are Solved

System API users currently authenticate using raw RSA public keys
configured via Path or KeyData. This approach doesn't integrate well
with Kubernetes tooling.

# How the Problems Are Solved

Allow for the `path`/`keyData` to be an X.509 certificate. 

The `NotBefore` and `NotAfter` fields of the certificate are beeing
respected when validating the JWT.

# Additional Changes

# Additional Context

- Closes #11442

---------

Co-authored-by: Livio Spring <[email protected]>
This commit is contained in:
Wim Van Laer
2026-03-23 13:32:27 +00:00
committed by GitHub
co-authored by Livio Spring
parent 85ce8c153b
commit 70adaff793
4 changed files with 321 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/defaults.yaml
+4 -2
View File
@@ -808,7 +808,9 @@ SystemAPIUsers:
# # Add keys for authentication of the systemAPI here:
# # you can specify any name for the user, but they will have to match the `issuer` and `sub` claim in the JWT:
# - superuser:
# Path: /path/to/superuser/ey.pem # you can provide the key either by reference with the path
# # you can provide the key either by reference with the path. The data in this file has to either be a public RSA
# # key or a public X.509 certificate
# Path: /path/to/superuser/key.pem
# Memberships:
# # MemberType System allows the user to access all APIs for all instances or organizations
# - MemberType: System
@@ -826,7 +828,7 @@ SystemAPIUsers:
# AggregateID: "123456789012345678"
# - superuser2:
# # If no memberships are specified, the user has a membership of type System with the role "SYSTEM_OWNER"
# KeyData: <base64 encoded key> # or you can directly embed it as base64 encoded value
# KeyData: <base64 encoded key> # or you can directly embed it as base64 encoded value or X.509 certificate contents
# Configure the SystemAPIUsers by environment variable using JSON notation:
# ZITADEL_SYSTEMAPIUSERS='{"systemuser":{"Path":"/path/to/superuser/key.pem"},"systemuser2":{"KeyData":"<base64 encoded key>"}}'