mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-13 09:25:12 +00:00
chore: rename authorization to role assignment (#11588)
# Which Problems Are Solved As part of the naming consistency initiative, the terms Authorization, User grants, internal authorization and other similar terms that are used in the context of assigning project roles to users are replaced by Role Assignments in the UI, API docs, and documentation. # How the Problems Are Solved By replacing the following terms with Role Assignments in API docs, Console UI, and guides. - Authorization - internal authorization - external authorization - User Grant - Roles and Authorizations By adding a note in the API docs to make it clear that Authorization within the context of Authorization Service API refers to role assignments, not to OAuth authorization as it is still used in the APIs. By updating some screenshots in documentation / guides to show "Role Assignments" instead of "Authorizations" in the UI. # Additional Changes N/A # Additional Context - Closes https://github.com/zitadel/zitadel/issues/11289 --------- Co-authored-by: Copilot <[email protected]>
This commit is contained in:
Gayathri Vijayan
co-authored by
Copilot
Copilot
parent
fa5e76661a
commit
93a4ed8857
@@ -1,11 +1,11 @@
|
||||
---
|
||||
title: ZITADEL with Next.js - A B2B Scenario
|
||||
sidebar_label: Next.js - B2B
|
||||
title: ZITADEL with Next.js – A B2B Scenario
|
||||
sidebar_label: Next.js – B2B
|
||||
---
|
||||
|
||||
This is our ZITADEL [Next.js](https://nextjs.org/) B2B template. It shows how to authenticate as a user with multiple organizations. The application shows your users roles on the selected organizations, other projects your organization is allowed to use and other users having a grant to use the application.
|
||||
This is our ZITADEL [Next.js](https://nextjs.org/) B2B template. It shows how to authenticate as a user with multiple organizations. The application shows your users' roles in the selected organizations, other projects your organization is allowed to use, and other users who have roles to use the application.
|
||||
|
||||
If you need more info on B2B use cases consider reading our guide for the [B2B solution scenario](/guides/solution-scenarios/b2b).
|
||||
If you need more info on B2B use cases, consider reading our guide for the [B2B solution scenario](/guides/solution-scenarios/b2b).
|
||||
|
||||
> You can follow along with the template code in our [zitadel-nextjs-b2b](https://github.com/zitadel/zitadel-nextjs-b2b) repo.
|
||||
|
||||
@@ -16,9 +16,9 @@ If you need more info on B2B use cases consider reading our guide for the [B2B s
|
||||
Users with `view` role can view granted projects on their organization which were granted by your organization (owning this portal application).
|
||||
Users with `admin` role can view granted projects and list users of the selected organization who are granted to use the portal application too.
|
||||
|
||||
## Setup Vendor application and users in ZITADEL
|
||||
## Set up Vendor application and users in ZITADEL
|
||||
|
||||
First we need to create an organization that holds the Vendor's users, projects and applications.
|
||||
First, we need to create an organization that holds the Vendor's users, projects, and applications.
|
||||
|
||||
### Vendor Organization
|
||||
|
||||
@@ -49,20 +49,20 @@ Copy the "Resource ID" of the application `portal-web` as you will need this in
|
||||
|
||||
### Roles
|
||||
|
||||
To set up the needed roles for your project, navigate to your `Portal` project, and add the following roles
|
||||
To set up the necessary roles for your project, navigate to your `Portal` project, and add the following roles
|
||||
|
||||
| Key | Display Name | Group | Description |
|
||||
|:-------|:--------------|:------|------------------------------------------------------------------------|
|
||||
| admin | Administrator | | The administrator, allowed to read granted projects and to user grants |
|
||||
| reader | Reader | | A user who is allowed to read his organizations granted projects only |
|
||||
| Key | Display Name | Group | Description |
|
||||
|:-------|:--------------|:------|----------------------------------------------------------------------------------|
|
||||
| admin | Administrator | | The administrator, allowed to read granted projects and to assign roles to users |
|
||||
| reader | Reader | | A user who is allowed to read his organization's granted projects only |
|
||||
|
||||
Now in the `General` section of the Portal project, make sure to enable `Assert Roles on Authentication`.
|
||||
This makes sure that roles, which is used by the application to enable UI components, are set in your OIDC ID Token.
|
||||
This makes sure that roles, which are used by the application to enable UI components, are set in your OIDC ID Token.
|
||||
|
||||
### Service Account
|
||||
|
||||
To make the application work you need a service account which loads granted-projects and user-grants for you.
|
||||
In the B2B-Demo organization, navigate to `Users` in navigation of Management Console, click on `Service Accounts` and create a new user.
|
||||
To make the application work, you need a service account which loads granted-projects and user-grants for you.
|
||||
In the B2B-Demo organization, navigate to `Users` in navigation of Management Console, click on `Service Accounts`, and create a new user.
|
||||
Let's set its username to `nextjs` and its name to `NextJS`. Then press `create`.
|
||||
|
||||
On the detail page of that user, navigate to "Personal Access Tokens" and add a new entry, set an optional expiration date.
|
||||
@@ -94,7 +94,7 @@ Replace the values as follows
|
||||
|
||||
`NEXTAUTH_URL`: Base url of this demo app (B2B portal); runs per default on [http://localhost:3000](http://localhost:3000)
|
||||
|
||||
`NEXT_PUBLIC_ZITADEL_ISSUER`: The url to your zitadel instance. When using zitadel.cloud for this demo you can find the domain of your ZITADEL instance in the customer portal. You can also find this information by going to your application `portal-web` and click 'URLs' in the navigation. The variable is prefixed with `NEXT_PUBLIC_` such that it can be accessed from the application.
|
||||
`NEXT_PUBLIC_ZITADEL_ISSUER`: The url to your zitadel instance. When using zitadel.cloud for this demo, you can find the domain of your ZITADEL instance in the customer portal. You can also find this information by going to your application `portal-web` and click 'URLs' in the navigation. The variable is prefixed with `NEXT_PUBLIC_` such that it can be accessed from the application.
|
||||
|
||||
`ZITADEL_API`: URL of the Management API. Typically, the same as `ZITADEL_ISSUER`.
|
||||
|
||||
@@ -104,11 +104,11 @@ Replace the values as follows
|
||||
|
||||
`ZITADEL_CLIENT_ID`: Having the project `Portal` selected, click on the Application `portal-web`. `${CLIENT_ID}` is displayed as a field in the OIDC configuration, labeled "Client ID" and has the format `12345678@portal`.
|
||||
|
||||
`SERVICE_ACCOUNT_ACCESS_TOKEN`: Set up a service account, add a Personal Access Token and copy the secret here (see below).
|
||||
`SERVICE_ACCOUNT_ACCESS_TOKEN`: Set up a service account, add a Personal Access Token, and copy the secret here (see below).
|
||||
|
||||
## Install and Run
|
||||
|
||||
To run this sample locally you need to install dependencies first.
|
||||
To run this sample locally, you need to install dependencies first.
|
||||
|
||||
Type and execute:
|
||||
|
||||
@@ -130,7 +130,7 @@ and open [http://localhost:3000](http://localhost:3000) with your browser to see
|
||||
|
||||
### Customer organization
|
||||
|
||||
Create a new organization in Console. Easiest way is to use the organization dropdown on the top left.
|
||||
Create a new organization in Console. The easiest way is to use the organization dropdown on the top left.
|
||||
Let's call this new organization `Demo-Customer`.
|
||||
|
||||
### Users
|
||||
@@ -154,11 +154,11 @@ Login with your user on the customer organization to validate the setup.
|
||||
Switch to the `Demo-Vendor` organization, select Projects in the navigation, and click on `Portal` and then `Project Grants`.
|
||||
[Grant all roles of the Project](/guides/manage/console/projects-overview#granted-projects-b2b) to the organization `demo-customer.$CUSTOM_DOMAIN.zitadel.cloud`.
|
||||
|
||||
### Authorization
|
||||
### Role Assignment
|
||||
|
||||
As you have guessed, these two users need to be authorized.
|
||||
As you have guessed, these two users need to be assigned roles.
|
||||
On the `Demo-Customer` organization, navigate to Projects and select "Granted Projects" in the sub-navigation.
|
||||
Select the project portal `Portal` and navigate to "Authorizations".
|
||||
Select the project portal `Portal` and navigate to "Role Assignments".
|
||||
|
||||
Give `Alice Admin` the roles `reader` and `admin`.
|
||||
`Eric Employee` will get only the role `reader`.
|
||||
|
||||
@@ -48,7 +48,7 @@ Also note the projects resource ID, as you will need it to configure your React
|
||||
|
||||
|
||||
|
||||
If you want to read your users roles from user info endpoint, make sure to enable the checkbox in your project.
|
||||
If you want to read your users roles from the user info endpoint, make sure to enable the checkbox in your project.
|
||||
|
||||
## React setup
|
||||
|
||||
|
||||
@@ -38,9 +38,9 @@ A `user` role is not required. This role is assumed by default for any authentic
|
||||
|
||||
|
||||
|
||||
Finally, we can assign the roles to users in the project's authorizations tab.
|
||||
Finally, we can assign the roles to users in the project's "Role Assignments" section.
|
||||
|
||||
|
||||
|
||||
|
||||
### Set up application and obtain secrets
|
||||
|
||||
@@ -279,7 +279,7 @@ You can customize the User Info that is obtained and stored by adjusting the `SC
|
||||
|
||||
### Controllers and templates
|
||||
|
||||
We need to create couple of Controllers and templates to define the app.
|
||||
We need to create a couple of Controllers and templates to define the app.
|
||||
|
||||
#### Index
|
||||
|
||||
|
||||
@@ -38,8 +38,8 @@ Continue and create the application.
|
||||
|
||||
### Refresh Token and Client ID
|
||||
|
||||
After successful creation of the app, make sure you tick the checkbox to enable refresh tokens.
|
||||
Also copy the client ID, as you will need it to configure your Vue application.
|
||||
After the successful creation of the app, make sure you tick the checkbox to enable refresh tokens.
|
||||
Also, copy the client ID, as you will need it to configure your Vue application.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -188,7 +188,7 @@ CLIENT_SECRET = "NVAp70IqiGmJldbS...."
|
||||
|
||||
1. Create a service account and a Personal Access Token (PAT) for that user by following [this guide](/guides/integrate/service-accounts/personal-access-token#create-a-service-account-with-a-pat).
|
||||
2. To enable authorization, follow [this guide](/guides/manage/console/roles) to create a role `read:messages` on your project.
|
||||
3. Next, create an authorization for the service account you created by adding the role `read:messages` to the user. Follow this [guide](/guides/manage/console/roles#authorizations) for more information on creating an authorization.
|
||||
3. Next, add the role `read:messages` to the service account you created. Follow this [guide](/guides/manage/console/roles#role-assignments) for more information on creating a role assignment.
|
||||
|
||||
### Run the API
|
||||
|
||||
|
||||
Reference in New Issue
Block a user