mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 13:52:51 +00:00
6127b567e7
# Which Problems Are Solved Expose impersonating actor to `preAccessToken` and `preUserinfo` actions. # How the Problems Are Solved Provide the `actor` information already present in the OIDC session model of JWT token to the relevant actions. Both goja-based actions "v1" and webhook based execution targets carry the actor information now. Actor remains null in case of non-impersonated tokens. Actor may contain nested actors to display a delegation chain of impersonators. # Additional Changes - dba6261c8ed0dfd00ffde6193910b1405b17432f: refactor `userinfoFlows` to reduce complexity, add test coverage and solve a couple of potential bugs. - `getClientId` in actions was previously undocumented. Added to documentation. - A skill that reproduces manual testing using webhook.site or a local sink. # Additional Context - Closes https://github.com/zitadel/zitadel/issues/12097 --------- Co-authored-by: Claude Sonnet 5 <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> Co-authored-by: Wim Van Laer <[email protected]>
231 lines
6.9 KiB
Plaintext
231 lines
6.9 KiB
Plaintext
---
|
|
title: Objects
|
|
description: "Documentation for the objects and data structures available within the ZITADEL Actions JavaScript environment."
|
|
---
|
|
|
|
## External User
|
|
|
|
- `externalId` *string*
|
|
User id from the identity provider
|
|
- `externalIdpId` *string*
|
|
ID of the identity provider
|
|
- `human`
|
|
- `firstName` *string*
|
|
- `lastName` *string*
|
|
- `nickName` *string*
|
|
- `displayName` *string*
|
|
- `preferredLanguage` *string*
|
|
In [RFC 5646](https://www.rfc-editor.org/rfc/rfc5646) format
|
|
- `email` *string*
|
|
- `isEmailVerified` *boolean*
|
|
- `phone` *string*
|
|
- `isPhoneVerified` *boolean*
|
|
|
|
## metadata with value as bytes
|
|
|
|
- `key` *string*
|
|
- `value` Array of *byte*
|
|
|
|
## metadata result
|
|
|
|
- `count` *number*
|
|
- `sequence` *number*
|
|
- `timestamp` *Date*
|
|
- `metadata` Array of [*metadata*](#metadata)
|
|
|
|
## metadata
|
|
|
|
- `creationDate` *Date*
|
|
- `changeDate` *Date*
|
|
- `resourceOwner` *string*
|
|
- `sequence` *number*
|
|
- `key` *string*
|
|
- `value` `Any`
|
|
|
|
## user grant
|
|
|
|
A user grant is a role assignment for a user.
|
|
|
|
- `projectID` *string*
|
|
Required. ID of the project for the role assignment.
|
|
- `projectGrantID` *string*
|
|
Optional. If the role assignment is for a project grant, include projectGrantID
|
|
- `roles` Array of *string*
|
|
Roles to assign to the user.
|
|
|
|
## user
|
|
|
|
- `id` *string*
|
|
- `creationDate` *Date*
|
|
- `changeDate` *Date*
|
|
- `resourceOwner` *string*
|
|
- `sequence` *number*
|
|
Unsigned 64-bit integer
|
|
- `state` *number*
|
|
<ul><li>0: unspecified</li><li>1: active</li><li>2: inactive</li><li>3: deleted</li><li>4: locked</li><li>5: suspended</li><li>6: initial</li></ul>
|
|
- `username` *string*
|
|
- `loginNames` Array of *string*
|
|
- `preferredLoginName` *string*
|
|
- `human`
|
|
Set if User (Human)
|
|
- `firstName` *string*
|
|
- `lastName` *string*
|
|
- `nickName` *string*
|
|
- `displayName` *string*
|
|
- `avatarKey` *string*
|
|
- `preferredLanguage` *string*
|
|
In [RFC 5646](https://www.rfc-editor.org/rfc/rfc5646) format
|
|
- `gender` *number*
|
|
<ul><li>0: unspecified</li><li>1: female</li><li>2: male</li><li>3: diverse</li></ul>
|
|
- `email` *string*
|
|
- `isEmailVerified` *boolean*
|
|
- `phone` *string*
|
|
- `isPhoneVerified` *boolean*
|
|
- `machine`
|
|
Set if the user is a machine
|
|
- `name` *string*
|
|
- `description` *string*
|
|
|
|
## human user
|
|
|
|
- `id` *string*
|
|
- `creationDate` *Date*
|
|
- `changeDate` *Date*
|
|
- `resourceOwner` *string*
|
|
- `sequence` *number*
|
|
- `state` *number*
|
|
<ul><li>0: unspecified</li><li>1: active</li><li>2: inactive</li><li>3: deleted</li><li>4: locked</li><li>5: suspended</li><li>6: initial</li></ul>
|
|
- `username` *string*
|
|
- `loginNames` Array of *string*
|
|
- `preferredLoginName` *string*
|
|
- `profile`
|
|
- `firstName` *string*
|
|
- `lastName` *string*
|
|
- `nickName` *string*
|
|
- `displayName` *string*
|
|
- `preferredLanguage` *string*
|
|
In [RFC 5646](https://www.rfc-editor.org/rfc/rfc5646) format
|
|
- `email`
|
|
- `email` *string*
|
|
- `isEmailVerified` *boolean*
|
|
- `phone`
|
|
- `phone` *string*
|
|
- `isPhoneVerified` *boolean*
|
|
|
|
## Auth Request
|
|
|
|
This object contains context information about the request to the [authorization endpoint](/apis/openidoauth/endpoints#authorization-endpoint).
|
|
|
|
- `id` *string*
|
|
- `agentId` *string*
|
|
- `creationDate` *Date*
|
|
- `changeDate` *Date*
|
|
- `browserInfo` *browserInfo*
|
|
- `userAgent` *string*
|
|
- `acceptLanguage` *string*
|
|
- `remoteIp` *string*
|
|
- `applicationId` *string*
|
|
- `callbackUri` *string*
|
|
- `transferState` *string*
|
|
- `prompt` Array of *Number*
|
|
<ul><li>0: not specified</li><li>1: none</li><li>2: login</li><li>3: consent</li><li>4: select_account</li><li>5: create</li></ul>
|
|
- `uiLocales` Array of *string*
|
|
- `loginHint` *string*
|
|
- `maxAuthAge` *Number*
|
|
Duration in nanoseconds
|
|
- `instanceId` *string*
|
|
- `request`
|
|
- `oidc`
|
|
- `scopes` Array of *string*
|
|
- `userId` *string*
|
|
- `userName` *string*
|
|
- `loginName` *string*
|
|
- `displayName` *string*
|
|
- `resourceOwner` *string*
|
|
- `requestedOrgId` *string*
|
|
- `requestedOrgName` *string*
|
|
- `requestedPrimaryDomain` *string*
|
|
- `requestedOrgDomain` *bool*
|
|
- `applicationResourceOwner` *string*
|
|
- `privateLabelingSetting` *Number*
|
|
<ul><li>0: Unspecified</li><li>1: Enforce project's policy</li><li>2: Allow user's organization login policy</li></ul>
|
|
- `selectedIdpConfigId` *string*
|
|
- `linkingUsers` Array of [*ExternalUser*](#external-user)
|
|
- `passwordVerified` *bool*
|
|
- `mfasVerified` Array of *Number*
|
|
<ul><li>0: OTP</li><li>1: U2F</li><li>2: U2F User verification</li></ul>
|
|
- `audience` Array of *string*
|
|
- `authTime` *Date*
|
|
|
|
## HTTP Request
|
|
|
|
This object is based on the Golang struct [http.Request](https://pkg.go.dev/net/http#Request), some attributes are removed as not all provided information is usable in this context.
|
|
|
|
- `method` *string*
|
|
- `url` *string*
|
|
- `proto` *string*
|
|
- `contentLength` *number*
|
|
- `host` *string*
|
|
- `form` Map *string* of Array of *string*
|
|
- `postForm` Map *string* of Array of *string*
|
|
- `remoteAddr` *string*
|
|
- `headers` Map *string* of Array of *string*
|
|
|
|
## Claims
|
|
|
|
This object represents [the claims](../openidoauth/claims) which will be written into the oidc token.
|
|
|
|
- `sub` *string*
|
|
- `name` *string*
|
|
- `email` *string*
|
|
- `locale` *string*
|
|
- `given_name` *string*
|
|
- `family_name` *string*
|
|
- `preferred_username` *string*
|
|
- `email_verified` *bool*
|
|
- `updated_at` *Number*
|
|
|
|
There could be additional fields depending on the settings of your [project](../../guides/manage/console/projects-overview#role-settings) and your [application](../../guides/manage/console/applications-overview#token-settings)
|
|
|
|
## token actor
|
|
|
|
This object represents the actor of a token, this is the party which obtained the token on behalf of the
|
|
subject through [token exchange](/guides/integrate/token-exchange#actor-token) or impersonation.
|
|
It corresponds to the [`act` claim](../openidoauth/claims) of the token and is `null` if the token has no actor.
|
|
|
|
- `userId` *string*
|
|
The id of the user acting on behalf of the subject
|
|
- `issuer` *string*
|
|
The issuer of the token the actor was authenticated with
|
|
- `actor` *token actor*
|
|
The previous actor in the delegation chain, `null` if there is none
|
|
|
|
## user grant list
|
|
|
|
This object represents a list of user grants (role assignments) stored in ZITADEL.
|
|
|
|
- `count` *Number*
|
|
- `sequence` *Number*
|
|
- `timestamp` *Date*
|
|
- `grants` Array of
|
|
- `id` *string*
|
|
- `projectGrantId` *string*
|
|
The id of the [project grant](/guides/solution-scenarios/saas#project-grant)
|
|
- `state` *Number*
|
|
<ul><li>0: unspecified</li><li>1: active</li><li>2: inactive</li><li>3: removed</li></ul>
|
|
- `creationDate` *Date*
|
|
- `changeDate` *Date*
|
|
- `sequence` *Number*
|
|
- `userId` *string*
|
|
- `roles` Array of *string*
|
|
- `userResourceOwner` *string*
|
|
The id of the organization of the user
|
|
- `userGrantResourceOwner` *string*
|
|
The id of the organization, where the user was granted
|
|
- `userGrantResourceOwnerName` *string*
|
|
The name of the organization, where the user was granted
|
|
- `projectId` *string*
|
|
- `projectName` *string*
|
|
- `getOrgMetadata()` [*metadataResult*](#metadata-result)
|
|
Get the metadata of the organization where the user was granted
|