andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-18 05:52:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): allow specifying access token type for user of type machine (#11599)

Browse Source 
# Which Problems Are Solved

The user service v2 didn't allow the specify or change the access token
type for users of type machine and referred to using the management API,
which in return was already deprecated and linked to the user service.

# How the Problems Are Solved

Added a possibility to specify the access token type in the creation and
update request.

# Additional Changes

None

# Additional Context

- closes #10850
- requires backport to v4.x

---------

Co-authored-by: Copilot <[email protected]>
This commit is contained in:
Livio Spring
2026-02-19 05:05:19 +00:00
committed by GitHub
co-authored by Copilot
parent a31e435491
commit e41b70b1e3
6 changed files with 176 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proto/zitadel/user/v2/user_service.proto
+28 -2
View File
@@ -2112,6 +2112,19 @@ message CreateUserRequest{
example: "\"The user calls the session API in the continuous integration pipeline for acceptance tests.\"";
}
];
// The access token type defines the type of access token that is generated for the user.
// By default, the access token type is an opaque Bearer token. You can change it to JWT,
// which will include more information about the user and their permissions in the token itself.
// This can be useful for machine users that need to call services that require more information about the user,
// without having to call the userinfo or introspection endpoint.
// However, revoked JWTs may still be considered valid until they expire.
// Always call the userinfo or introspection endpoint to verify that a JWT is still valid.
AccessTokenType access_token_type = 3 [
(validate.rules).enum = {defined_only: true},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
example: "\"ACCESS_TOKEN_TYPE_BEARER\"";
}
];
}
// The unique identifier of the organization the user belongs to.
string organization_id = 1 [
@@ -2160,8 +2173,8 @@ message CreateUserRequest{
Human human = 4;
// Users of type machine are users that are meant to be used by a machine.
// In order to authenticate, [add a secret](/docs/reference/api/user/zitadel.user.v2.UserService.AddSecret), [a key](/docs/reference/api/user/zitadel.user.v2.UserService.AddKey) or [a personal access token](/docs/reference/api/user/zitadel.user.v2.UserService.AddPersonalAccessToken) to the user.
// Tokens generated for new users of type machine will be of an opaque Bearer type.
// You can change the users token type to JWT by using the management v1 service method UpdateMachine.
// By default, tokens generated for new users of type machine will be of an opaque Bearer type.
// You can change it to JWT by specifying the access token type in the machine field.
Machine machine = 5;
}
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_schema) = {
@@ -2543,6 +2556,19 @@ message UpdateUserRequest{
example: "\"The user calls the session API in the continuous integration pipeline for acceptance tests.\"";
}
];
// The access token type defines the type of access token that is generated for the user.
// By default, the access token type is an opaque Bearer token. You can change it to JWT,
// which will include more information about the user and their permissions in the token itself.
// This can be useful for machine users that need to call services that require more information about the user,
// without having to call the userinfo or introspection endpoint.
// However, revoked JWT tokens might still be considered valid until they expire.
// Therefore, you must call the userinfo or introspection endpoint to check whether they are still valid.
optional AccessTokenType access_token_type = 3 [
(validate.rules).enum = {defined_only: true},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
example: "\"ACCESS_TOKEN_TYPE_BEARER\"";
}
];
}
// The user id is the users unique identifier in the instance.
// It can't be changed.