mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-11 16:45:13 +00:00
docs: introduce versioned docs and migrate to fuma (#11166)
## Todos for release - [x] Configure Env in docs project on vercel - [x] Configure Root Path in the docs project on vercel - [ ] Remove old CSP https://github.com/zitadel/website/pull/1592 ## What we did This pull request migrates the project documentation from the old `docs/` directory to the new `apps/docs/` directory, introduces a new documentation system built with Next.js and Fumadocs, and updates all relevant references, configuration files, and documentation to reflect this change. It also adds new configuration and ignore files for the new documentation app, updates CI and linting to exclude the new docs from certain checks, and revises the contributing guidelines accordingly. **Documentation System Migration and New Docs App** * Migrated all documentation from `docs/` to `apps/docs/`, and updated all references in `README.md`, `CONTRIBUTING.md`, and other files to point to the new location. [[1]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L585-L640) [[2]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L660-R607) [[3]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L740-R687) [[4]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L2-R3) [[5]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L30-R30) * Added a new Next.js/Fumadocs-based documentation app under `apps/docs/`, including core app files, layouts, routing, search API, and a comprehensive `README.md` with development and contribution instructions. [[1]](diffhunk://#diff-5a1b07344a2c1b4d3f37b23ff1388b62cd9f57dea3c1cd23d8a0412b7602b132R1-R74) [[2]](diffhunk://#diff-462b9ad1eabbb7d1c29bb9c36e4931eb180fd7190900e6d2babf8f4d66ad1c28R1-R39) [[3]](diffhunk://#diff-e16ae25660ded787b10ac35dea96d5ecaacf895dae0afc8a9bd4382dc79a8c87R1-R7) [apps/docs/app/[[...slug]]/layout.tsxR1-R81](diffhunk://#diff-59e08acde4e805b7aeccef1dcf98f1d71dfc550777e6b9402085cee0e9fa4e0aR1-R81), [apps/docs/app/[[...slug]]/page.tsxR1-R79](diffhunk://#diff-e5df3f80d0fa01e12d63d81f29c57a9d14e846c78fd3beabb2ef768e38fd9580R1-R79), [[4]](diffhunk://#diff-389b34918e040cacaa87cd7201ffa462cc2b0b716736f537e3d3c660ac69353bR1-R7) [[5]](diffhunk://#diff-d3b03416d1c457b19f1c27b26f2db741412df841b875c26ccadc36e4522247f4R1-R29) [[6]](diffhunk://#diff-c8fb8339570a5305809be7c618e14705fd86390dc278e6ce8ba224a7bc8b0c3cR1-R25) **Configuration and Tooling Updates** * Updated `.github/workflows/codeql.yml`, `.golangci.yaml`, and `.github/dependabot.yml` to properly handle the new docs app: excluded `apps/docs` from certain checks, added npm dependency updates for the docs app, and excluded generated content. [[1]](diffhunk://#diff-12783128521e452af0cfac94b99b8d250413c516ec71fe6d97dbea666ff7ba27L8-R14) [[2]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R5-R6) [[3]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R126-R129) [[4]](diffhunk://#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28R89-R106) * Updated `.devcontainer/devcontainer.json` to use the latest Go 1.25.3 version for consistency. **Licensing and Miscellaneous** * Added `apps/docs/` to the list of licensed directories in `LICENSING.md`. These changes ensure the documentation is now maintained in a modern, scalable system and all project tooling is updated to support the new structure. --------- Co-authored-by: Federico Coppede <[email protected]>
This commit is contained in:
Florian Forster
co-authored by
Federico Coppede
Federico Coppede
parent
7b6395c348
commit
d8ea041c56
@@ -0,0 +1,49 @@
|
||||
---
|
||||
title: Register and Create User
|
||||
---
|
||||
|
||||
The ZITADEL API has different possibilities to create users.
|
||||
This can be used, if you are building your own registration page.
|
||||
|
||||
Use the following API call to create your users:
|
||||
[Create User (Human)](/reference/api/user/zitadel.user.v2.UserService.AddHumanUser)
|
||||
|
||||
## With Username and Password
|
||||
|
||||
If you are collecting all the user information and a password, you can directly create the user with the password.
|
||||
With the `password_change_required` flag you can choose if the user has to change the password on the first login or not.
|
||||
This might make sense if an administrator created the user.
|
||||
|
||||
## With passkey
|
||||
|
||||
You can directly ask for a link to create the passkey registration for the user.
|
||||
Fill the user data and set the attribute `request_passwordless_registration` to true.
|
||||
You will get a link for the registration and an expiration time in the response.
|
||||
|
||||
If you add `requestPlatformType` as query parameter to the link you can define what type the platform should be.
|
||||
- **platform**: Device itself e.g. FaceID, Fingerprint etc.
|
||||
- **crossPlatform** A hardware token e.g SoloKey
|
||||
- **unspecified** The user is free to choose
|
||||
|
||||
If nothing is requested, the type will not be restricted and all possibilities of the device will be taken into account.
|
||||
|
||||
### Add passkey to existing user
|
||||
|
||||
If you already have a user in ZITADEL, it is possible to add passkey later.
|
||||
|
||||
[Add Passkey Registration ](/apis/resources/mgmt)
|
||||
|
||||
Send the user_id in the request and you will get a link and an expiration as response.
|
||||
You can then customize the link the same as described above in the creation process.
|
||||
|
||||
The second possibility is to send the link directly to the user per email.
|
||||
Use the following request in that case:
|
||||
|
||||
[Send Passkey Registration ](/apis/resources/mgmt)
|
||||
|
||||
## Verified Email Address
|
||||
|
||||
When creating users you can define wether you want to verify their email address before activating the user.
|
||||
|
||||
In case you want to create the user with an verified email address set the `isEmailVerified` property to `true`.
|
||||
No initialization email will be sent to the user.
|
||||
@@ -0,0 +1,124 @@
|
||||
---
|
||||
title: SCIM v2.0
|
||||
---
|
||||
|
||||
Zitadel’s **[SCIM v2](https://scim.cloud/) service provider interface** enables standardized provisioning and lifecycle management of users and other IAM resources.
|
||||
By implementing the official *System for Cross-domain Identity Management (SCIM) v2.0* specification, Zitadel allows seamless and automated user creation, updates, deactivation, and deprovisioning across systems.
|
||||
|
||||
## API
|
||||
|
||||
For full reference details of Zitadel’s SCIM API, consult the API documentation [here](/apis/scim2).
|
||||
|
||||
## Provisioning domain
|
||||
|
||||
A **provisioning domain** represents an external administrative domain—separate from the service provider—typically introduced for legal, organizational, or technical reasons.
|
||||
Refer to the SCIM specification definitions in **RFC7643**:
|
||||
https://datatracker.ietf.org/doc/html/rfc7643#section-1.2
|
||||
|
||||
Zitadel uses provisioning domains to scope the handling of the SCIM **`externalId`**, ensuring that different customers or systems provisioning users do not conflict with each other.
|
||||
|
||||
### Setting a provisioning domain
|
||||
|
||||
A provisioning domain can be assigned to a **machine user** by adding the following metadata entry:
|
||||
|
||||
- **Key:** `urn:zitadel:scim:provisioningDomain`
|
||||
- **Value:** the name of the provisioning domain
|
||||
|
||||
### How Zitadel stores `externalId`
|
||||
|
||||
If a machine user has a provisioning domain set, any SCIM `externalId` provided during user provisioning or lookup is stored under:
|
||||
`urn:zitadel:scim:{provisioningDomain}:externalId`
|
||||
|
||||
If *no* provisioning domain is configured, Zitadel falls back to a simplified metadata key:
|
||||
`urn:zitadel:scim:externalId`
|
||||
|
||||
This ensures that different provisioning sources remain isolated, and the correct `externalId` is returned when queried through SCIM.
|
||||
|
||||
## Mapping
|
||||
|
||||
The following table describes how Zitadel maps SCIM User attributes to Zitadel user fields.
|
||||
Attributes without a direct Zitadel equivalent are stored in **user metadata**.
|
||||
For more information about user metadata, see [here](../customize/user-metadata).
|
||||
|
||||
| SCIM | Zitadel | Remarks |
|
||||
|------------------------|-----------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `id` | `userId` | |
|
||||
| `username` | `username` | |
|
||||
| `name.formatted` | `profile.displayName` | The SCIM attribute `displayName` takes precedence over `name.formatted` |
|
||||
| `name.familyName` | `profile.familyName` | |
|
||||
| `name.middleName` | `metadata[urn:zitadel:scim:name.middleName]` | |
|
||||
| `name.honorificPrefix` | `metadata[urn:zitadel:scim:name.honorificPrefix]` | |
|
||||
| `name.honorificSuffix` | `metadata[urn:zitadel:scim:name.honorificSuffix]` | |
|
||||
| `displayName` | `profile.displayName` | The SCIM attribute `displayName` takes precedence over `name.formatted` |
|
||||
| `nickName` | `profile.nickName` | |
|
||||
| `profileUrl` | `metadata[urn:zitadel:scim:profileUrl]` | |
|
||||
| `title` | `metadata[urn:zitadel:scim:title]` | |
|
||||
| `preferredLanguage` | `profile.preferredLanguage` | |
|
||||
| `locale` | `metadata[urn:zitadel:scim:locale]` | |
|
||||
| `timezone` | `metadata[urn:zitadel:scim:timezone]` | |
|
||||
| `active` | `state` | `Initial` and `Active` are mapped to `active = true`, all other states are mapped to `active = false`.<br />The `active` value can only be updated if the user is in the state `Active` or `Inactive`. |
|
||||
| `password` | `password` | |
|
||||
| `emails` | `email` | Only the `primary` email is stored in Zitadel, if there is no `primary` email, the first one is stored. By default emails from SCIM are considered verified, this can be adjusted in the [configuration](#configuration). |
|
||||
| `phoneNumbers` | `phone` | Only the `primary` phone number is stored in Zitadel, if there is no `primary` phone number, the first one is stored. By default phone numbers from SCIM are considered verified, this can be adjusted in the [configuration](#configuration). |
|
||||
| `ims` | `metadata[urn:zitadel:scim:ims]` | Serialized as JSON. |
|
||||
| `photos` | `metadata[urn:zitadel:scim:photos]` | Serialized as JSON. |
|
||||
| `addresses` | `metadata[urn:zitadel:scim:addresses]` | Serialized as JSON. |
|
||||
| `entitlements` | `metadata[urn:zitadel:scim:entitlements]` | Serialized as JSON. |
|
||||
| `roles` | `metadata[urn:zitadel:scim:roles]` | Serialized as JSON. |
|
||||
| `externalId` | `metadata[urn:zitadel:scim:externalId]`<br />`metadata[urn:zitadel:scim:{provisioningDomain}:externalId]` | See [provisioning domain](#provisioning-domain). |
|
||||
|
||||
## Configuration
|
||||
|
||||
This section provides details on the runtime configuration of the SCIM interface of Zitadel.
|
||||
|
||||
### Defaults
|
||||
|
||||
- Emails from SCIM are treated as **verified**
|
||||
- Phone numbers from SCIM are treated as **verified**
|
||||
- Bulk SCIM operations can include up to **100 operations**
|
||||
- Maximum SCIM request body size is **1 MB**
|
||||
|
||||
This behavior can be adjusted through the Zitadel runtime configuration settings:
|
||||
|
||||
```yaml
|
||||
SCIM:
|
||||
EmailVerified: true
|
||||
PhoneVerified: true
|
||||
MaxRequestBodySize: 1_000_000
|
||||
Bulk:
|
||||
MaxOperationsCount: 100
|
||||
```
|
||||
|
||||
## Limitations
|
||||
|
||||
Zitadel’s SCIM implementation follows the core SCIM specification but includes the following limitations.
|
||||
|
||||
### Supported schemas
|
||||
|
||||
Zitadel currently supports only the SCIM User schema: `urn:ietf:params:scim:schemas:core:2.0:User`
|
||||
Group provisioning and other extended schemas are not supported.
|
||||
|
||||
### Required attributes
|
||||
|
||||
In addition to SCIM-standard required fields, Zitadel requires:
|
||||
|
||||
* `name.familyName`
|
||||
* `name.givenName`
|
||||
* `emails`: at least one email is required
|
||||
|
||||
### Duplicated attribute mapping
|
||||
|
||||
The SCIM user attributes `name.formatted` and `displayName` are both mapped to the `profile.displayName` attribute in
|
||||
Zitadel.
|
||||
If both are provided, `displayName` always takes precedence and is the value that will be stored and returned in future SCIM queries.
|
||||
|
||||
## Resources
|
||||
|
||||
- **[Zitadel SCIM API Documentation](/apis/scim2)**: Documentation of Zitadel's SCIM API implementation.
|
||||
- **[SCIM](https://scim.cloud/)**: The Webpage of SCIM.
|
||||
- **[RFC7643](https://tools.ietf.org/html/rfc7643) Core Schema**:
|
||||
The Core Schema provides a platform-neutral schema and extension model for representing users and groups.
|
||||
- **[RFC7644](https://tools.ietf.org/html/rfc7644) Protocol**:
|
||||
The SCIM Protocol is an application-level, REST protocol for provisioning and managing identity data on the web.
|
||||
- **[RFC7642](https://tools.ietf.org/html/rfc7642) Definitions, Overview, Concepts, and Requirements**:
|
||||
This document lists the user scenarios and use cases of System for Cross-domain Identity Management (SCIM).
|
||||
Reference in New Issue
Block a user