mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-02 20:32:19 +00:00
09cf7cf0ae
# Which Problems Are Solved This PR marks the OAuth2 Token Exchange as general available (GA). # How the Problems Are Solved - API: - deprecated the feature toggle (to prevent breaking changes) in v2beta and v2 API - removed all related event logic and updated the projection interation - removed the toggle usage for token exchange - removed related translations - Management Console: - removed the feature toggle and its translations - Docs: - removed all beta labels and feature toggle notes # Additional Changes - removed unused `Errors.WebKey.FeatureDisabled` translations # Additional Context - closes #11114 --------- Co-authored-by: Marco A. <[email protected]>
201 lines
9.0 KiB
Protocol Buffer
201 lines
9.0 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
package zitadel.feature.v2;
|
|
|
|
import "protoc-gen-openapiv2/options/annotations.proto";
|
|
import "validate/validate.proto";
|
|
|
|
import "zitadel/object/v2/object.proto";
|
|
import "zitadel/feature/v2/feature.proto";
|
|
|
|
option go_package = "github.com/zitadel/zitadel/pkg/grpc/feature/v2;feature";
|
|
|
|
message SetInstanceFeaturesRequest{
|
|
reserved 2, 3, 6, 8, 11;
|
|
reserved "oidc_trigger_introspection_projections", "oidc_legacy_introspection", "actions", "web_key", "disable_user_token_event";
|
|
|
|
optional bool login_default_org = 1 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "The login UI will use the settings of the default org (and not from the instance) if no organization context is set";
|
|
}
|
|
];
|
|
|
|
optional bool user_schema = 4 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "User Schemas allow to manage data schemas of user. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage.";
|
|
}
|
|
];
|
|
|
|
// Deprecated: the flag has been removed and `urn:ietf:params:oauth:grant-type:token-exchange`
|
|
// grant type for the OIDC token endpoint is enabled by default.
|
|
// Token exchange can be used to request tokens with a lesser scope or impersonate other users.
|
|
// See the security policy to allow impersonation on an instance.
|
|
// This field is only kept for backward compatibility and will be removed in the next major version of Zitadel.
|
|
// Setting the field will have no effect.
|
|
optional bool oidc_token_exchange = 5 [
|
|
deprecated = true
|
|
];
|
|
|
|
repeated ImprovedPerformance improved_performance = 7 [
|
|
(validate.rules).repeated.unique = true,
|
|
(validate.rules).repeated.items.enum = {defined_only: true, not_in: [0]},
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "[1]";
|
|
description: "Improves performance of specified execution paths.";
|
|
}
|
|
];
|
|
|
|
optional bool debug_oidc_parent_error = 9 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Return parent errors to OIDC clients for debugging purposes. Parent errors may contain sensitive data or unwanted details about the system status of zitadel. Only enable if really needed.";
|
|
}
|
|
];
|
|
|
|
optional bool oidc_single_v1_session_termination = 10 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If the flag is enabled, you'll be able to terminate a single session from the login UI by providing an id_token with a `sid` claim as id_token_hint on the end_session endpoint. Note that currently all sessions from the same user agent (browser) are terminated in the login UI. Sessions managed through the Session API already allow the termination of single sessions.";
|
|
}
|
|
];
|
|
|
|
optional bool enable_back_channel_logout = 12 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions.";
|
|
}
|
|
];
|
|
|
|
optional LoginV2 login_v2 = 13 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
description: "Specify the login UI for all users and applications regardless of their preference.";
|
|
}
|
|
];
|
|
|
|
optional bool permission_check_v2 = 14 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Enable a newer, more performant, permission check used for v2 and v3 resource based APIs.";
|
|
}
|
|
];
|
|
|
|
optional bool console_use_v2_user_api = 15 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If this is enabled the management console web client will use the new User v2 API for certain calls";
|
|
}
|
|
];
|
|
|
|
optional bool enable_relational_tables = 16 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If this is enabled Zitadel will use the relational tables instead of the projections as the main source to store the data. Regardless of the flag state, both the relational table and the projections are kept up to date. Currently the flag has no effect.";
|
|
}
|
|
];
|
|
}
|
|
|
|
message SetInstanceFeaturesResponse {
|
|
zitadel.object.v2.Details details = 1;
|
|
}
|
|
|
|
message ResetInstanceFeaturesRequest {}
|
|
|
|
message ResetInstanceFeaturesResponse {
|
|
zitadel.object.v2.Details details = 1;
|
|
}
|
|
|
|
message GetInstanceFeaturesRequest {
|
|
bool inheritance = 1 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Inherit unset features from the resource owners. This option is recursive: if the flag is set, the resource's ancestors are consulted up to system defaults. If this option is disabled and the feature is not set on the instance, it will be omitted from the response or Not Found is returned when the instance has no features flags at all.";
|
|
}
|
|
];
|
|
}
|
|
|
|
message GetInstanceFeaturesResponse {
|
|
reserved 3, 4, 7, 9, 12;
|
|
reserved "oidc_trigger_introspection_projections", "oidc_legacy_introspection", "actions", "web_key", "disable_user_token_event";
|
|
|
|
zitadel.object.v2.Details details = 1;
|
|
FeatureFlag login_default_org = 2 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "The login UI will use the settings of the default org (and not from the instance) if no organization context is set";
|
|
}
|
|
];
|
|
|
|
FeatureFlag user_schema = 5 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "User Schemas allow to manage data schemas of user. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage.";
|
|
}
|
|
];
|
|
|
|
// Deprecated: the flag has been removed and `urn:ietf:params:oauth:grant-type:token-exchange`
|
|
// grant type for the OIDC token endpoint is enabled by default.
|
|
// Token exchange can be used to request tokens with a lesser scope or impersonate other users.
|
|
// See the security policy to allow impersonation on an instance.
|
|
// This field is only kept for backward compatibility and will be removed in the next major version of Zitadel.
|
|
FeatureFlag oidc_token_exchange = 6 [
|
|
deprecated = true
|
|
];
|
|
|
|
ImprovedPerformanceFeatureFlag improved_performance = 8 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "[1]";
|
|
description: "Improves performance of specified execution paths.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag debug_oidc_parent_error = 10 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Return parent errors to OIDC clients for debugging purposes. Parent errors may contain sensitive data or unwanted details about the system status of zitadel. Only enable if really needed.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag oidc_single_v1_session_termination = 11 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If the flag is enabled, you'll be able to terminate a single session from the login UI by providing an id_token with a `sid` claim as id_token_hint on the end_session endpoint. Note that currently all sessions from the same user agent (browser) are terminated in the login UI. Sessions managed through the Session API already allow the termination of single sessions.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag enable_back_channel_logout = 13 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions.";
|
|
}
|
|
];
|
|
|
|
LoginV2FeatureFlag login_v2 = 14 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If the flag is set, all users will be redirected to the login V2 regardless of the application's preference.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag permission_check_v2 = 15 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
description: "Enable a newer, more performant, permission check used for v2 and v3 resource based APIs.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag console_use_v2_user_api = 16 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If this is enabled the management console web client will use the new User v2 API for certain calls";
|
|
}
|
|
];
|
|
|
|
FeatureFlag enable_relational_tables = 17 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If this is enabled Zitadel will use the relational tables instead of the projections as the main source to store the data. Regardless of the flag state, both the relational table and the projections are kept up to date. Currently the flag has no effect.";
|
|
}
|
|
];
|
|
}
|