andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-15 10:25:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(group): add user groups to token claims (#11009)

Browse Source 
# Which Problems Are Solved

If the groups of a user is requested through a scope, details related to
the user's groups are added in the token claims.

# How the Problems Are Solved
By querying the user groups that the user is a part of, and setting them
in the token claims.

This PR introduces two scopes to request user groups: `groups` and
`urn:zitadel:iam:user:groups`
* `groups` returns an array of group names in the token claims with the
same name
* `urn:zitadel:iam:user:groups` returns an array of JSON objects with
information about the user groups in the token claims with the same name

# Additional Changes

N/A

# Additional Context

- Closes #9702 
- Follow-up for PRs:
  * #10455 
  * #10853 
  * #10758 
  * #10940

---------

Co-authored-by: Livio Spring <[email protected]>
This commit is contained in:
Gayathri Vijayan
2025-11-11 09:06:45 +01:00
committed by GitHub
co-authored by Livio Spring
parent e4a959c321
commit a9846498a9
8 changed files with 140 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/oidc/integration_test/userinfo_test.go
+40
View File
@@ -30,6 +30,13 @@ func TestServer_UserInfo(t *testing.T) {
clientID, projectID := createClient(t, Instance)
addProjectRolesGrants(t, User.GetUserId(), projectID, roleFoo, roleBar)
// create user groups
group1 := Instance.CreateGroup(CTXIAM, t, Instance.DefaultOrg.GetId(), "group1")
group2 := Instance.CreateGroup(CTXIAM, t, Instance.DefaultOrg.GetId(), "group2")
// add the user to groups
Instance.AddUsersToGroup(CTXIAM, t, group1.GetId(), []string{User.GetUserId()})
Instance.AddUsersToGroup(CTXIAM, t, group2.GetId(), []string{User.GetUserId()})
tests := []struct {
name string
prepare func(t *testing.T, clientID string, scope []string) *oidc.Tokens[*oidc.IDTokenClaims]
@@ -154,6 +161,39 @@ func TestServer_UserInfo(t *testing.T) {
},
},
},
{
name: "custom group scope",
prepare: getTokens,
scope: []string{oidc.ScopeProfile, oidc.ScopeOpenID, oidc.ScopeEmail, oidc.ScopeOfflineAccess,
oidc_api.ScopeCustomUserGroups},
assertions: []func(*testing.T, *oidc.UserInfo){
assertUserinfo,
func(t *testing.T, info *oidc.UserInfo) {
expectedUserGroups := []map[string]interface{}{
{"id": group1.GetId(), "name": "group1"},
{"id": group2.GetId(), "name": "group2"},
}
userGroupsClaim := info.Claims[oidc_api.ClaimCustomUserGroups]
require.Len(t, userGroupsClaim, len(expectedUserGroups))
assert.ElementsMatch(t, expectedUserGroups, userGroupsClaim)
},
},
},
{
name: "group scope",
prepare: getTokens,
scope: []string{oidc.ScopeProfile, oidc.ScopeOpenID, oidc.ScopeEmail, oidc.ScopeOfflineAccess,
oidc_api.ScopeUserGroups},
assertions: []func(*testing.T, *oidc.UserInfo){
assertUserinfo,
func(t *testing.T, info *oidc.UserInfo) {
expectedUserGroups := []string{"group1", "group2"}
userGroupsClaim := info.Claims[oidc_api.ClaimUserGroups]
require.Len(t, userGroupsClaim, len(expectedUserGroups))
assert.ElementsMatch(t, expectedUserGroups, userGroupsClaim)
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {