mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-09 15:45:12 +00:00
docs: fixed some typos, formatting, grammar (#11540)
# Which Problems Are Solved - Typos - Punctuation - Markdown table formatting - ... (A bunch of issues my editor gave) # How the Problems Are Solved # Additional Changes # Additional Context
This commit is contained in:
Wim Van Laer
@@ -1,11 +1,11 @@
|
||||
| Parameter | Description |
|
||||
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| grant_type | Must be `urn:ietf:params:oauth:grant-type:token-exchange` |
|
||||
| subject_token | A token that represents the identity of the party on behalf of whom the request is being made. |
|
||||
| subject_token_type | An identifier that indicates the type of the token in the subject_token parameter. |
|
||||
| actor_token | Optional. A token that represents the identity of the acting party. In ZITADEL this the impersonator. |
|
||||
| actor_token_type | An identifier that indicates the type of the token in the actor_token parameter. Required when actor_token is provided |
|
||||
| requested_token_type | Optional. An identifier that indicates the type of the token requested. Defaults to access token if not provided. |
|
||||
| Parameter | Description |
|
||||
|----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| grant_type | Must be `urn:ietf:params:oauth:grant-type:token-exchange` |
|
||||
| subject_token | A token that represents the identity of the party on behalf of whom the request is being made. |
|
||||
| subject_token_type | An identifier that indicates the type of the token in the subject_token parameter. |
|
||||
| actor_token | Optional. A token that represents the identity of the acting party. In ZITADEL this the impersonator. |
|
||||
| actor_token_type | An identifier that indicates the type of the token in the actor_token parameter. Required when actor_token is provided |
|
||||
| requested_token_type | Optional. An identifier that indicates the type of the token requested. Defaults to access token if not provided. |
|
||||
| scope | [Scopes](/apis/openidoauth/scopes) you would like to request from ZITADEL for the requested token. Scopes are space delimited, e.g. `openid email profile`. |
|
||||
| audience | Optional. Must be a subset of the combined audiences from both subject and actor tokens. |
|
||||
| resource | Currently not supported |
|
||||
| audience | Optional. Must be a subset of the combined audiences from both subject and actor tokens. |
|
||||
| resource | Currently not supported |
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
| Property | Description |
|
||||
| ----------------- | ------------------------------------------------------------------------------------ |
|
||||
|-------------------|--------------------------------------------------------------------------------------|
|
||||
| access_token | An `access_token` as opaque token or JWT for the subject user |
|
||||
| token_type | Type of the `access_token`. Value can be `Bearer` or `N_A` |
|
||||
| issued_token_type | [Token type](#token-types) of the returned token, matches the `requested_token_type` |
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
The following table provides a matrix of supported token type parameter and responses for Token Exchange.
|
||||
|
||||
| Identifier | subject_token | actor_token | requested_token_type |
|
||||
| ------------------------------------------------ | ------------------------------------------------------------ | ------------- | -------------------- |
|
||||
|--------------------------------------------------|--------------------------------------------------------------|---------------|----------------------|
|
||||
| `urn:ietf:params:oauth:token-type:access_token` | JWT or Opaque | JWT or Opaque | Opaque only |
|
||||
| `urn:ietf:params:oauth:token-type:refresh_token` | Not allowed | Not allowed | Not allowed |
|
||||
| `urn:ietf:params:oauth:token-type:id_token` | Allowed | Allowed | Allowed |
|
||||
|
||||
@@ -44,13 +44,13 @@ Key JSON
|
||||
|
||||
JWT
|
||||
|
||||
| Claim | Example | Description |
|
||||
|:------|:---------------------------|:----------------------------------------------------------------------------------------------------------------|
|
||||
| Claim | Example | Description |
|
||||
|:------|:-----------------------------|:----------------------------------------------------------------------------------------------------------------|
|
||||
| aud | `"https://${CUSTOM_DOMAIN}"` | String or Array of intended audiences MUST include ZITADEL's issuing domain |
|
||||
| exp | `1605183582` | Unix timestamp of the expiry |
|
||||
| iat | `1605179982` | Unix timestamp of the creation singing time of the JWT, MUST NOT be older than 1h |
|
||||
| iss | `"78366401571920522@acme"` | String which represents the requesting party (owner of the key), normally the `clientID` from the json key file |
|
||||
| sub | `"78366401571920522@acme"` | The subject ID of the application, normally the `clientID` from the json key file |
|
||||
| exp | `1605183582` | Unix timestamp of the expiry |
|
||||
| iat | `1605179982` | Unix timestamp of the creation singing time of the JWT, MUST NOT be older than 1h |
|
||||
| iss | `"78366401571920522@acme"` | String which represents the requesting party (owner of the key), normally the `clientID` from the json key file |
|
||||
| sub | `"78366401571920522@acme"` | The subject ID of the application, normally the `clientID` from the json key file |
|
||||
|
||||
```json
|
||||
{
|
||||
|
||||
@@ -15,7 +15,7 @@ An OpenID Connect (OIDC) [authentication request](https://openid.net/specs/openi
|
||||
|
||||
## Why this OIDC playground?
|
||||
|
||||
Currently ZITADEL requires human users to authenticate trough the hosted login page.
|
||||
Currently, ZITADEL requires human users to authenticate through the hosted login page.
|
||||
Your application should initiate a login by issuing an authentication request and redirecting the user to the login page. You can customize the behavior of ZITADEL by providing additional parameters and scopes in the request.
|
||||
|
||||
This playground should help you to initially craft an authentication request and to explore the behavior of ZITADEL in more depth.
|
||||
@@ -117,7 +117,7 @@ Please refer to the full [guide on branding](/guides/manage/customize/branding).
|
||||
Pass the scope `urn:zitadel:iam:user:metadata` to request a user's metadata.
|
||||
Please refer to the full [guide on user-metadata](/guides/manage/customize/user-metadata) for further details.
|
||||
|
||||
### Access core apis
|
||||
### Access core APIs
|
||||
|
||||
Calling the [core API](/apis/introduction) with the authenticated user, requires that the projectID of ZITADEL is included in the audience claim.
|
||||
|
||||
|
||||
@@ -47,7 +47,7 @@ Please check below the matrix for an overview where which scope is asserted.
|
||||
| Claims | Example | Description |
|
||||
|:-------------------|:---------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| acr | TBA | TBA |
|
||||
| act | `{"iss": "${CUSTOM_DOMAIN}","sub": "259241944654282754"}` | JSON object describing the actor from the `actor_token` after [token exchange](/guides/integrate/token-exchange#actor-token) |
|
||||
| act | `{"iss": "${CUSTOM_DOMAIN}","sub": "259241944654282754"}` | JSON object describing the actor from the `actor_token` after [token exchange](/guides/integrate/token-exchange#actor-token) |
|
||||
| address | `Lerchenfeldstrasse 3, 9014 St. Gallen` | TBA |
|
||||
| amr | `pwd mfa` | Authentication Method References as defined in [RFC8176](https://tools.ietf.org/html/rfc8176) <br/> `password` value is deprecated, please check `pwd` |
|
||||
| aud | `69234237810729019` | The audience of the token, by default all client id's and the project id are included |
|
||||
@@ -106,13 +106,13 @@ https://github.com/zitadel/actions/blob/main/examples/custom_roles.js#L20-L33
|
||||
|
||||
ZITADEL reserves some claims to assert certain data. Please check out the [reserved scopes](./scopes#reserved-scopes).
|
||||
|
||||
| Claims | Example | Description |
|
||||
|:--------------------------------------------------|:---------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| urn:zitadel:iam:action:\{actionname}:log | `{"urn:zitadel:iam:action:appendCustomClaims:log": ["test log", "another test log"]}` | This claim is set during Actions as a log, e.g. if two custom claims with the same keys are set. |
|
||||
| urn:zitadel:iam:org:domain:primary:\{domainname} | `{"urn:zitadel:iam:org:domain:primary": "acme.ch"}` | This claim represents the primary domain of the organization the user belongs to. |
|
||||
| Claims | Example | Description |
|
||||
|:--------------------------------------------------|:---------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| urn:zitadel:iam:action:\{actionname}:log | `{"urn:zitadel:iam:action:appendCustomClaims:log": ["test log", "another test log"]}` | This claim is set during Actions as a log, e.g. if two custom claims with the same keys are set. |
|
||||
| urn:zitadel:iam:org:domain:primary:\{domainname} | `{"urn:zitadel:iam:org:domain:primary": "acme.ch"}` | This claim represents the primary domain of the organization the user belongs to. |
|
||||
| urn:zitadel:iam:org:project:roles | `{"urn:zitadel:iam:org:project:roles": [ {"user": {"id1": "acme.zitade.ch", "id2": "caos.ch"} } ] }` | When roles are asserted, ZITADEL does this by providing the `id` and `primaryDomain` below the role. This gives you the option to check in which organization a user has the role on the current project (where your application belongs to). |
|
||||
| urn:zitadel:iam:org:project:\{projectid}:roles | `{"urn:zitadel:iam:org:project:id3:roles": [ {"user": {"id1": "acme.zitade.ch", "id2": "caos.ch"} } ] }` | When roles are asserted, ZITADEL does this by providing the `id` and `primaryDomain` below the role. This gives you the option to check in which organization a user has the role on a specific project. |
|
||||
| urn:zitadel:iam:user:metadata | `{"urn:zitadel:iam:user:metadata": [ {"key": "VmFsdWU=" } ] }` | The metadata claim will include all metadata of a user. The values are base64 encoded. |
|
||||
| urn:zitadel:iam:user:resourceowner:id | `{"urn:zitadel:iam:user:resourceowner:id": "orgid"}` | This claim represents the user's organization ID. |
|
||||
| urn:zitadel:iam:user:resourceowner:name | `{"urn:zitadel:iam:user:resourceowner:name": "ACME"}` | This claim represents the user's organization's name. |
|
||||
| urn:zitadel:iam:user:resourceowner:primary_domain | `{"urn:zitadel:iam:user:resourceowner:primary_domain": "acme.ch"}` | This claim represents the user's organization's primary domain. |
|
||||
| urn:zitadel:iam:org:project:\{projectid}:roles | `{"urn:zitadel:iam:org:project:id3:roles": [ {"user": {"id1": "acme.zitade.ch", "id2": "caos.ch"} } ] }` | When roles are asserted, ZITADEL does this by providing the `id` and `primaryDomain` below the role. This gives you the option to check in which organization a user has the role on a specific project. |
|
||||
| urn:zitadel:iam:user:metadata | `{"urn:zitadel:iam:user:metadata": [ {"key": "VmFsdWU=" } ] }` | The metadata claim will include all metadata of a user. The values are base64 encoded. |
|
||||
| urn:zitadel:iam:user:resourceowner:id | `{"urn:zitadel:iam:user:resourceowner:id": "orgid"}` | This claim represents the user's organization ID. |
|
||||
| urn:zitadel:iam:user:resourceowner:name | `{"urn:zitadel:iam:user:resourceowner:name": "ACME"}` | This claim represents the user's organization's name. |
|
||||
| urn:zitadel:iam:user:resourceowner:primary_domain | `{"urn:zitadel:iam:user:resourceowner:primary_domain": "acme.ch"}` | This claim represents the user's organization's primary domain. |
|
||||
|
||||
@@ -6,7 +6,7 @@ sidebar_label: Grant Types
|
||||
For a list of supported or unsupported `Grant Types` please have a look at the table below.
|
||||
|
||||
| Grant Type | Supported |
|
||||
| :---------------------------------------------------- | :-------- |
|
||||
|:------------------------------------------------------|:----------|
|
||||
| Authorization Code | yes |
|
||||
| Authorization Code with PKCE | yes |
|
||||
| Client Credentials | yes |
|
||||
@@ -57,7 +57,7 @@ Our service user work with the JWT profile to authenticate them against ZITADEL.
|
||||
Key JSON
|
||||
|
||||
| Key | Example | Description |
|
||||
| :----- | :------------------------------------------------------------------ | :----------------------------------------------------------------- |
|
||||
|:-------|:--------------------------------------------------------------------|:-------------------------------------------------------------------|
|
||||
| type | `"serviceaccount"` | The type of account, right now only serviceaccount is valid |
|
||||
| keyId | `"81693565968772648"` | This is unique ID of the key |
|
||||
| key | `"-----BEGIN RSA PRIVATE KEY-----...-----END RSA PRIVATE KEY-----"` | The private key generated by ZITADEL, this can not be regenerated! |
|
||||
@@ -76,13 +76,13 @@ Key JSON
|
||||
|
||||
JWT
|
||||
|
||||
| Claim | Example | Description |
|
||||
| :---- | :------------------------- | :------------------------------------------------------------------------------------------------------------ |
|
||||
| Claim | Example | Description |
|
||||
|:------|:-----------------------------|:--------------------------------------------------------------------------------------------------------------|
|
||||
| aud | `"https://${CUSTOM_DOMAIN}"` | String or Array of intended audiences MUST include ZITADEL's issuing domain |
|
||||
| exp | `1605183582` | Unix timestamp of the expiry |
|
||||
| iat | `1605179982` | Unix timestamp of the creation singing time of the JWT, MUST NOT be older than 1h |
|
||||
| iss | `"77479219772321307"` | String which represents the requesting party (owner of the key), normally the `userId` from the json key file |
|
||||
| sub | `"77479219772321307"` | The subject ID of the service user, normally the `userId` from the json key file |
|
||||
| exp | `1605183582` | Unix timestamp of the expiry |
|
||||
| iat | `1605179982` | Unix timestamp of the creation singing time of the JWT, MUST NOT be older than 1h |
|
||||
| iss | `"77479219772321307"` | String which represents the requesting party (owner of the key), normally the `userId` from the json key file |
|
||||
| sub | `"77479219772321307"` | The subject ID of the service user, normally the `userId` from the json key file |
|
||||
|
||||
```json
|
||||
{
|
||||
|
||||
@@ -8,7 +8,7 @@ ZITADEL supports the usage of scopes as way of requesting information from the i
|
||||
## Standard Scopes
|
||||
|
||||
| Scopes | Description |
|
||||
| :------------- | ------------------------------------------------------------------------------ |
|
||||
|:---------------|--------------------------------------------------------------------------------|
|
||||
| openid | When using openid connect this is a mandatory scope |
|
||||
| profile | Optional scope to request the profile of the subject |
|
||||
| email | Optional scope to request the email of the subject |
|
||||
@@ -21,14 +21,14 @@ ZITADEL supports the usage of scopes as way of requesting information from the i
|
||||
In addition to the standard compliant scopes we utilize the following scopes.
|
||||
|
||||
| Scopes | Example | Description |
|
||||
| :------------------------------------------------ | :----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
|:--------------------------------------------------|:-------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `urn:zitadel:iam:org:project:role:{rolekey}` | `urn:zitadel:iam:org:project:role:user` | By using this scope a client can request the claim `urn:zitadel:iam:org:project:roles` to be asserted when possible. As an alternative approach you can enable all roles to be asserted from the [project](/guides/manage/console/roles#authorizations) a client belongs to. |
|
||||
| `urn:zitadel:iam:org:projects:roles` | `urn:zitadel:iam:org:projects:roles` | By using this scope a client can request the claim `urn:zitadel:iam:org:project:{projectid}:roles` to be asserted for each requested project. All projects of the token audience, requested by the `urn:zitadel:iam:org:project:id:{projectid}:aud` scopes will be used. |
|
||||
| `urn:zitadel:iam:org:id:{id}` | `urn:zitadel:iam:org:id:178204173316174381` | When requesting this scope **ZITADEL** will enforce that the user is a member of the selected organization. If the organization does not exist a failure is displayed. It will assert the `urn:zitadel:iam:user:resourceowner` claims. |
|
||||
| `urn:zitadel:iam:org:domain:primary:{domainname}` | `urn:zitadel:iam:org:domain:primary:acme.ch` | When requesting this scope **ZITADEL** will enforce that the user is a member of the selected organization and the username is suffixed by the provided domain. If the organization does not exist a failure is displayed |
|
||||
| `urn:zitadel:iam:org:roles:id:{orgID}` | `urn:zitadel:iam:org:roles:id:178204173316174381` | This scope can be used one or more times to limit the granted organization IDs in the returned roles. Unknown organization IDs are ignored. When this scope is not used, all granted organizations are returned inside the roles. |
|
||||
| `urn:zitadel:iam:org:project:id:{projectid}:aud` | `urn:zitadel:iam:org:project:id:69234237810729019:aud` | By adding this scope, the requested project id will be added to the audience of the access token |
|
||||
| `urn:zitadel:iam:org:project:id:{projectid}:aud` | `urn:zitadel:iam:org:project:id:69234237810729019:aud` | By adding this scope, the requested project id will be added to the audience of the access token |
|
||||
| `urn:zitadel:iam:org:project:id:zitadel:aud` | `urn:zitadel:iam:org:project:id:zitadel:aud` | By adding this scope, the ZITADEL project id will be added to the audience of the access token |
|
||||
| `urn:zitadel:iam:user:metadata` | `urn:zitadel:iam:user:metadata` | By adding this scope, the metadata of the user will be included in the token. The values are base64 encoded. |
|
||||
| `urn:zitadel:iam:user:resourceowner` | `urn:zitadel:iam:user:resourceowner` | By adding this scope: id, name and primary_domain of the user's organization will be included in the token. |
|
||||
| `urn:zitadel:iam:user:resourceowner` | `urn:zitadel:iam:user:resourceowner` | By adding this scope: id, name and primary_domain of the user's organization will be included in the token. |
|
||||
| `urn:zitadel:iam:org:idp:id:{idp_id}` | `urn:zitadel:iam:org:idp:id:76625965177954913` | By adding this scope the user will directly be redirected to the identity provider to authenticate. Make sure you also send the primary domain scope if a custom login policy is configured. Otherwise the system will not be able to identify the identity provider. |
|
||||
|
||||
Reference in New Issue
Block a user