mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-29 10:32:15 +00:00
Max PeintnerandGitHub
790244dd49
# Which Problems Are Solved - Logins through the new login via a Zitadel identity provider with `instanceRolesInfo` configured (e.g. support access) create/update the user, but the instance member roles from the `urn:zitadel:iam:org:project:roles` claim are never assigned — that synchronization only exists in the login v1 flow. Support users therefore end up without any permissions. # How the Problems Are Solved - New `syncInstanceRolesFromIdpIntent` in the login, called after user auto-creation and on existing-user logins. It mirrors the v1 filtering: roles are only honored for ZITADEL IdPs with `instanceRolesInfo`, when granted in a configured organization (matched on ID and domain) and using an instance role key (`IAM_` prefix). Memberships are written merge-only via the v2 `InternalPermissionService` (existing roles are never removed), and a failed sync logs a warning without blocking the login. # Additional Changes - Unit tests for the claim-to-role filtering. # Additional Context - Part of the "ZITADEL as an Identity Provider" epic: #5127 - Follow-up for PR #xxx (ZITADEL provider sign-in button in the new login)
30 lines
1.9 KiB
TypeScript
30 lines
1.9 KiB
TypeScript
import { create } from "@bufbuild/protobuf";
|
|
import { FeatureService } from "@zitadel/proto/zitadel/feature/v2/feature_service_pb.js";
|
|
import { IdentityProviderService } from "@zitadel/proto/zitadel/idp/v2/idp_service_pb.js";
|
|
import { InternalPermissionService } from "@zitadel/proto/zitadel/internal_permission/v2/internal_permission_service_pb.js";
|
|
import { RequestContextSchema } from "@zitadel/proto/zitadel/object/v2/object_pb.js";
|
|
import { OIDCService } from "@zitadel/proto/zitadel/oidc/v2/oidc_service_pb.js";
|
|
import { OrganizationService } from "@zitadel/proto/zitadel/org/v2/org_service_pb.js";
|
|
import { SAMLService } from "@zitadel/proto/zitadel/saml/v2/saml_service_pb.js";
|
|
import { SessionService } from "@zitadel/proto/zitadel/session/v2/session_service_pb.js";
|
|
import { SettingsService } from "@zitadel/proto/zitadel/settings/v2/settings_service_pb.js";
|
|
import { UserService } from "@zitadel/proto/zitadel/user/v2/user_service_pb.js";
|
|
|
|
import { createClientFor } from "./helpers.js";
|
|
|
|
export const createUserServiceClient = createClientFor(UserService);
|
|
export const createSettingsServiceClient = createClientFor(SettingsService);
|
|
export const createSessionServiceClient = createClientFor(SessionService);
|
|
export const createOIDCServiceClient = createClientFor(OIDCService);
|
|
export const createSAMLServiceClient = createClientFor(SAMLService);
|
|
export const createOrganizationServiceClient = createClientFor(OrganizationService);
|
|
export const createFeatureServiceClient = createClientFor(FeatureService);
|
|
export const createIdpServiceClient = createClientFor(IdentityProviderService);
|
|
export const createInternalPermissionServiceClient = createClientFor(InternalPermissionService);
|
|
|
|
export function makeReqCtx(orgId: string | undefined) {
|
|
return create(RequestContextSchema, {
|
|
resourceOwner: orgId ? { case: "orgId", value: orgId } : { case: "instance", value: true },
|
|
});
|
|
}
|