mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
6127b567e7
# Which Problems Are Solved Expose impersonating actor to `preAccessToken` and `preUserinfo` actions. # How the Problems Are Solved Provide the `actor` information already present in the OIDC session model of JWT token to the relevant actions. Both goja-based actions "v1" and webhook based execution targets carry the actor information now. Actor remains null in case of non-impersonated tokens. Actor may contain nested actors to display a delegation chain of impersonators. # Additional Changes - dba6261c8ed0dfd00ffde6193910b1405b17432f: refactor `userinfoFlows` to reduce complexity, add test coverage and solve a couple of potential bugs. - `getClientId` in actions was previously undocumented. Added to documentation. - A skill that reproduces manual testing using webhook.site or a local sink. # Additional Context - Closes https://github.com/zitadel/zitadel/issues/12097 --------- Co-authored-by: Claude Sonnet 5 <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> Co-authored-by: Wim Van Laer <[email protected]>
84 lines
3.5 KiB
Plaintext
84 lines
3.5 KiB
Plaintext
---
|
|
title: Complement Token Flow
|
|
description: "Complement Token Flow in ZITADEL Actions to add custom claims to your ID and access tokens."
|
|
---
|
|
|
|
This flow is executed during the creation of tokens and token introspection.
|
|
|
|
The flow is represented by the following Ids in the API: `2`
|
|
|
|
## Pre Userinfo creation (id_token / userinfo / introspection endpoint)
|
|
|
|
This trigger is called before userinfo are set in the id_token or userinfo and introspection endpoint response.
|
|
|
|
The trigger is represented by the following Ids in the API: `4`
|
|
|
|
### Parameters of Pre Userinfo creation
|
|
|
|
- `ctx`
|
|
The first parameter contains the following fields:
|
|
- `v1`
|
|
- `claims` [*Claims*](./objects#claims)
|
|
- `getUser()` [*User*](./objects#user)
|
|
- `user`
|
|
- `getMetadata()` [*metadataResult*](./objects#metadata-result)
|
|
- `grants` [*UserGrantList*](./objects#user-grant-list)
|
|
- `org`
|
|
- `getMetadata()` [*metadataResult*](./objects#metadata-result)
|
|
- `application`
|
|
- `getClientId()` *string*
|
|
The client id of the application the token was requested for
|
|
- `actor` [*token actor*](./objects#token-actor)
|
|
The party which obtained the token on behalf of the user, `null` unless the token was obtained through token exchange or impersonation
|
|
- `api`
|
|
The second parameter contains the following fields:
|
|
- `v1`
|
|
- `userinfo`
|
|
This function is deprecated, please use `api.v1.claims`
|
|
- `setClaim(string, Any)`
|
|
Sets any value if the key is not already present. If it's already present there is a message added to `urn:zitadel:iam:action:${action.name}:log`
|
|
Note that keys with prefix `urn:zitadel:iam` will be ignored.
|
|
- `claims`
|
|
- `setClaim(string, Any)`
|
|
Sets any value if the key is not already present. If it's already present there is a message added to `urn:zitadel:iam:action:${action.name}:log`
|
|
Note that keys with prefix `urn:zitadel:iam` will be ignored.
|
|
- `user`
|
|
- `setMetadata(string, Any)`
|
|
Key of the metadata and any value
|
|
|
|
## Pre access token creation
|
|
|
|
This trigger is called before the claims are set in the access token and the token type is `jwt`.
|
|
|
|
The trigger is represented by the following Ids in the API: `5`
|
|
|
|
### Parameters of Pre access token creation
|
|
|
|
- `ctx`
|
|
The first parameter contains the following fields:
|
|
- `v1`
|
|
- `claims` [*Claims*](./objects#claims)
|
|
- `getUser()` [*User*](./objects#user)
|
|
- `user`
|
|
- `getMetadata()` [*metadataResult*](./objects#metadata-result)
|
|
- `grants` [*UserGrantList*](./objects#user-grant-list)
|
|
- `org`
|
|
- `getMetadata()` [*metadataResult*](./objects#metadata-result)
|
|
- `application`
|
|
- `getClientId()` *string*
|
|
The client id of the application the token was requested for
|
|
- `actor` [*token actor*](./objects#token-actor)
|
|
The party which obtained the token on behalf of the user, `null` unless the token was obtained through token exchange or impersonation
|
|
- `api`
|
|
The second parameter contains the following fields:
|
|
- `v1`
|
|
- `claims`
|
|
- `setClaim(string, Any)`
|
|
Sets any value if the key is not already present. If it's already present there is a message added to `urn:zitadel:iam:action:${action.name}:log`
|
|
Note that keys with prefix `urn:zitadel:iam` will be ignored.
|
|
- `appendLogIntoClaims(string)`
|
|
Appends the entry into the claim `urn:zitadel:action:{action.name}:log` the value of the claim is an Array of *string*
|
|
- `user`
|
|
- `setMetadata(string, Any)`
|
|
Key of the metadata and any value
|