Files
zitadel/apps/docs
8e442ed4bc fix(oidc): allow OrgRoleIDScope downscoping in token exchange (#12563)
# Which Problems Are Solved

- Token exchange rejects `urn:zitadel:iam:org:roles🆔{orgID}` when
that scope is not already present on the subject or actor token
(`invalid_scope`).
- A documented least-privilege pattern — exchanging a broad access token
for one whose roles claims are limited to a single organization — has
been broken since the v4.15.3 token-exchange hardening and was not
restored by #12312.
- A naive allow-any-`roles:id` exception would let a previously narrowed
token widen again (switch org filter, or drop the filter and get all
role orgs), including via an actor token's filter on actor-path
exchanges.
- A client-requested bare `urn:zitadel:iam:org:roles🆔` (empty org id)
is not a meaningful filter and should be rejected on exchange.

# How the Problems Are Solved

- Treats `OrgRoleIDScope` as a restriction filter with downscope-only
semantics via `applyOrgRoleIDScopeDownscoping(requested,
ceilingScopes)`:
- union / standard exchange passes the **subject** token scopes as the
ceiling (actor filters ignored)
- impersonation (scopeless `user_id` / `id_token` subject) passes the
**actor** token scopes as the ceiling
- ceiling unfiltered → any requested `roles:id` is allowed (broad →
narrow)
  - ceiling filtered → requested filters must be ⊆ that set
- ceiling filtered but request omits them → inherit the ceiling (omit
must not re-widen)
- Rejects a **client-requested** bare `urn:zitadel:iam:org:roles🆔` in
`validateTokenExchangeScopes` after normalize (before empty-request
fallback). Input tokens may still carry the bare prefix as a degenerate
ceiling; empty-request / omit inherit does not re-trigger the rejection.
- Keeps non-restriction scopes on the existing subject ∪ actor presence
checks.
- Adds unit coverage for downscope, further downscope, widen rejection,
omit-inherit, mixed subject/actor filters, empty-scope access/JWT
subjects, and bare-prefix request/ceiling cases.
- Adds an integration test for broad → `roles:id` filtered roles, plus a
second exchange that rejects widening to another org.
- Documents downscope-only and omit-inherit behavior in the reserved
scopes table and the token exchange guide.

# Additional Changes

- Updates the token-exchange guide Scope section to reflect that
authorization-related reserved scopes must already be present on input
tokens (aligned with the v4.15.3 hardening), rather than suggesting
scope can be freely extended.

# Additional Context

- Closes #12413
- Follow-up for PR #12312
- Related discussion in #11869 (recommended `roles:id` workaround; this
restores that path for token exchange without allowing filter widening)
- Behavior note for release notes: during token exchange, an existing
`urn:zitadel:iam:org:roles🆔*` filter on the subject is inherited when
omitted from the request, so role claims cannot re-widen.

---------

Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
2026-08-28 16:27:56 +02:00
..
2026-01-30 18:11:12 +00:00

@zitadel/docs

Documentation for Zitadel, built with Fumadocs and Next.js.

Getting Started

Ensure you have followed the root quick start to set up dependencies.

Local Development

Ensure all dependencies are installed:

pnpm install

Start the development server:

pnpm nx run @zitadel/docs:dev

The site will be available at http://localhost:3000.

Scripts

Key scripts for documentation workflows:

Script Description
dev Starts the development server.
build Builds the production application.
fetch:remote-content Fetches remote tags and referenced content.
generate Runs all generation steps (fetch:remote-content, generate:proto-docs, generate:api-reference, generate:index-pages).
check:links Validates content integrity (broken links, missing frontmatter, schema errors).
check-types Validates typescript types.
test Runs all validation steps (check-types, check:links).
lint checks for code style and syntax errors (ESLint).
clean Cleans the build output and generated files.

Validation

  • Code Quality: Run pnpm nx run @zitadel/docs:lint to check for syntax and style issues in JS/TS/MDX files.
  • Content Integrity: Run pnpm nx run @zitadel/docs:check-links to validate content structure, including:
    • Broken internal links
    • Missing required front-matter (e.g., title)
    • Image references

Troubleshooting

Issue: Nx configuration not found or "nx" command not found

If you see errors like:

 NX   Cannot find configuration for task @zitadel/zitadel:@zitadel/docs:generate

Pass --verbose to see the stacktrace.

or

pnpm nx run @zitadel/docs:dev
 ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL  Command "nx" not found

Did you mean "pnpm nx"?

Root cause: Your dependency cache or node_modules is out of sync.

Solution: Run these commands from the repository root in order:

  1. Clear node_modules: rm -rf node_modules — removes the installed dependency folder
  2. Clear pnpm cache: pnpm cache delete — clears pnpm's internal package cache
  3. Reinstall dependencies: pnpm install — reinstalls all dependencies fresh
  4. Test the setup: pnpm nx run @zitadel/docs:generate — verifies everything works

This resolves 99% of setup-related issues.

Contributing

Build Process

The docs build process automatically handles the following steps via generate:

  1. Downloads required protoc plugins.
  2. Generates gRPC documentation from proto files.
  3. Generates API documentation from OpenAPI specs.
  4. Generates index files for directory structures.

Style Guide

  • Variables: Use environment variables in code snippets where possible.
  • Embedded Content: Use _filename.mdx for content embedded in other pages (not indexed individually).
  • Code Embedding: Use the file property in code blocks to embed code from the repo.
  • Voice: Use active voice and sentence case for titles.

Refer to the Google Developer Style Guide for general guidelines.

Adding Content

All documentation content is located in the content directory. Note that the system strictly accepts only .mdx files.

To add a new page:

  1. Create a .mdx file in the appropriate subdirectory of content.
  2. Register the new page in the sidebar settings at lib/sidebar-data.ts to make it accessible in the navigation.

Pull Requests

Use docs(<scope>): <short summary> for PR titles. Pass quality checks before submitting:

pnpm nx run @zitadel/docs:build