mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-07 22:55:12 +00:00
Livio SpringandGitHub
382a97c30f
# Which Problems Are Solved The end_session_endpoint currently always requires the userAgent cookie to be able to terminate session created through the hosted login UI. Only tokens issued through the Login V2 can be used to directly terminate a specific session and without the need of a cookie. This PR adds the possibility to terminate a single V1 session or all V1 sessions belonging to the same user agent without the need of the userAgent cookie by providing an id_token as `id_token_hint` which contains the id of a V1 session as `sid`. # How the Problems Are Solved - #8525 added the `sid` claim for id_tokens issued through the login UI - The `sid` can now be checked for the `V1_` prefix and queries for either the userAgentID and depending on the `OIDCSingleV1SessionTermination` flag all userIDs of active session from the same user agent id - The `OIDCSingleV1SessionTermination` flag is added with default value false to keep the existing behavior of terminating all sessions even in case of providing an id_token_hint # Additional Changes - pass `context.Context` into session view functions for querying the database with that context # Additional Context - relates to #8499 - closes #8501
175 lines
8.5 KiB
Protocol Buffer
175 lines
8.5 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
package zitadel.feature.v2;
|
|
|
|
import "protoc-gen-openapiv2/options/annotations.proto";
|
|
import "validate/validate.proto";
|
|
|
|
import "zitadel/object/v2/object.proto";
|
|
import "zitadel/feature/v2/feature.proto";
|
|
|
|
option go_package = "github.com/zitadel/zitadel/pkg/grpc/feature/v2;feature";
|
|
|
|
message SetInstanceFeaturesRequest{
|
|
optional bool login_default_org = 1 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "The login UI will use the settings of the default org (and not from the instance) if no organization context is set";
|
|
}
|
|
];
|
|
optional bool oidc_trigger_introspection_projections = 2 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Enable projection triggers during an introspection request. This can act as workaround if there are noticeable consistency issues in the introspection response but can have an impact on performance. We are planning to remove triggers for introspection requests in the future. Please raise an issue if you needed to enable this feature.";
|
|
}
|
|
];
|
|
optional bool oidc_legacy_introspection = 3 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "We have recently refactored the introspection endpoint for performance reasons. This feature can be used to rollback to the legacy implementation if unexpected bugs arise. Please raise an issue if you needed to enable this feature.";
|
|
}
|
|
];
|
|
|
|
optional bool user_schema = 4 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "User Schemas allow to manage data schemas of user. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage.";
|
|
}
|
|
];
|
|
|
|
optional bool oidc_token_exchange = 5 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Enable the experimental `urn:ietf:params:oauth:grant-type:token-exchange` grant type for the OIDC token endpoint. Token exchange can be used to request tokens with a lesser scope or impersonate other users. See the security policy to allow impersonation on an instance.";
|
|
}
|
|
];
|
|
optional bool actions = 6 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Actions allow to manage data executions and targets. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage.";
|
|
}
|
|
];
|
|
|
|
repeated ImprovedPerformance improved_performance = 7 [
|
|
(validate.rules).repeated.unique = true,
|
|
(validate.rules).repeated.items.enum = {defined_only: true, not_in: [0]},
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "[1]";
|
|
description: "Improves performance of specified execution paths.";
|
|
}
|
|
];
|
|
|
|
optional bool web_key = 8 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Enable the webkey/v3alpha API. The first time this feature is enabled, web keys are generated and activated.";
|
|
}
|
|
];
|
|
|
|
optional bool debug_oidc_parent_error = 9 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Return parent errors to OIDC clients for debugging purposes. Parent errors may contain sensitive data or unwanted details about the system status of zitadel. Only enable if really needed.";
|
|
}
|
|
];
|
|
|
|
optional bool oidc_single_v1_session_termination = 10 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If the flag is enabled, you'll be able to terminate a single session from the login UI by providing an id_token with a `sid` claim as id_token_hint on the end_session endpoint. Note that currently all sessions from the same user agent (browser) are terminated in the login UI. Sessions managed through the Session API already allow the termination of single sessions.";
|
|
}
|
|
];
|
|
}
|
|
|
|
message SetInstanceFeaturesResponse {
|
|
zitadel.object.v2.Details details = 1;
|
|
}
|
|
|
|
message ResetInstanceFeaturesRequest {}
|
|
|
|
message ResetInstanceFeaturesResponse {
|
|
zitadel.object.v2.Details details = 1;
|
|
}
|
|
|
|
message GetInstanceFeaturesRequest {
|
|
bool inheritance = 1 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Inherit unset features from the resource owners. This option is recursive: if the flag is set, the resource's ancestors are consulted up to system defaults. If this option is disabled and the feature is not set on the instance, it will be omitted from the response or Not Found is returned when the instance has no features flags at all.";
|
|
}
|
|
];
|
|
}
|
|
|
|
message GetInstanceFeaturesResponse {
|
|
zitadel.object.v2.Details details = 1;
|
|
FeatureFlag login_default_org = 2 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "The login UI will use the settings of the default org (and not from the instance) if no organization context is set";
|
|
}
|
|
];
|
|
|
|
FeatureFlag oidc_trigger_introspection_projections = 3 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Enable projection triggers during an introspection request. This can act as workaround if there are noticeable consistency issues in the introspection response but can have an impact on performance. We are planning to remove triggers for introspection requests in the future. Please raise an issue if you needed to enable this feature.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag oidc_legacy_introspection = 4 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "We have recently refactored the introspection endpoint for performance reasons. This feature can be used to rollback to the legacy implementation if unexpected bugs arise. Please raise an issue if you needed to enable this feature.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag user_schema = 5 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "User Schemas allow to manage data schemas of user. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag oidc_token_exchange = 6 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Enable the experimental `urn:ietf:params:oauth:grant-type:token-exchange` grant type for the OIDC token endpoint. Token exchange can be used to request tokens with a lesser scope or impersonate other users. See the security policy to allow impersonation on an instance.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag actions = 7 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Actions v2 allow to manage data executions and targets. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage.";
|
|
}
|
|
];
|
|
|
|
ImprovedPerformanceFeatureFlag improved_performance = 8 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "[1]";
|
|
description: "Improves performance of specified execution paths.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag web_key = 9 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Enable the webkey/v3alpha API. The first time this feature is enabled, web keys are generated and activated.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag debug_oidc_parent_error = 10 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "Return parent errors to OIDC clients for debugging purposes. Parent errors may contain sensitive data or unwanted details about the system status of zitadel. Only enable if really needed.";
|
|
}
|
|
];
|
|
|
|
FeatureFlag oidc_single_v1_session_termination = 11 [
|
|
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
|
|
example: "true";
|
|
description: "If the flag is enabled, you'll be able to terminate a single session from the login UI by providing an id_token with a `sid` claim as id_token_hint on the end_session endpoint. Note that currently all sessions from the same user agent (browser) are terminated in the login UI. Sessions managed through the Session API already allow the termination of single sessions.";
|
|
}
|
|
];
|
|
}
|