mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
9067605b66
* fix(crypto): use authenticated encryption for IDP intent tokens IDP intent tokens were encrypted with AES-CFB which provides no integrity protection, making them malleable. Switch to A256GCM via the existing AuthAlgorithm interface (EncryptToken/DecryptToken), the same approach already used for OIDC and session tokens. The idpConfigEncryption key type is widened from EncryptionAlgorithm to AuthEncryptionAlgorithm so that data-at-rest encryption (IDP client secrets, LDAP bind passwords, SAML keys) continues to use the CFB path unmodified. Co-authored-by: Cursor <[email protected]> * fix(proto): raise IDP intent token max length to 500 for authenticated tokens The switch to authenticated A256GCM (JWE compact serialization) makes IDP intent tokens longer (~270 chars) than the previous AES-CFB base64 output. Raise the max_len/max_length validation and OpenAPI constraints on every idp_intent_token field from 200 to 500 so the new tokens are accepted: user v2/v2beta (idp + user_service), session v2/v2beta, and resources user v3alpha. Co-Authored-By: Claude Opus 4.8 <[email protected]> --------- Co-authored-by: Cursor <[email protected]> Co-authored-by: Claude Opus 4.8 <[email protected]>
82 lines
2.2 KiB
Go
82 lines
2.2 KiB
Go
package user
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"connectrpc.com/connect"
|
|
"google.golang.org/protobuf/reflect/protoreflect"
|
|
|
|
"github.com/zitadel/zitadel/internal/api/authz"
|
|
"github.com/zitadel/zitadel/internal/api/grpc/server"
|
|
"github.com/zitadel/zitadel/internal/command"
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/query"
|
|
user "github.com/zitadel/zitadel/pkg/grpc/user/v2beta"
|
|
"github.com/zitadel/zitadel/pkg/grpc/user/v2beta/userconnect"
|
|
)
|
|
|
|
var _ userconnect.UserServiceHandler = (*Server)(nil)
|
|
|
|
type Server struct {
|
|
command *command.Commands
|
|
query *query.Queries
|
|
userCodeAlg crypto.EncryptionAlgorithm
|
|
idpAlg crypto.AuthEncryptionAlgorithm
|
|
idpCallback func(ctx context.Context) string
|
|
samlRootURL func(ctx context.Context, idpID string) string
|
|
|
|
assetAPIPrefix func(context.Context) string
|
|
|
|
checkPermission domain.PermissionCheck
|
|
}
|
|
|
|
type Config struct{}
|
|
|
|
func CreateServer(
|
|
command *command.Commands,
|
|
query *query.Queries,
|
|
userCodeAlg crypto.EncryptionAlgorithm,
|
|
idpAlg crypto.AuthEncryptionAlgorithm,
|
|
idpCallback func(ctx context.Context) string,
|
|
samlRootURL func(ctx context.Context, idpID string) string,
|
|
assetAPIPrefix func(ctx context.Context) string,
|
|
checkPermission domain.PermissionCheck,
|
|
) *Server {
|
|
return &Server{
|
|
command: command,
|
|
query: query,
|
|
userCodeAlg: userCodeAlg,
|
|
idpAlg: idpAlg,
|
|
idpCallback: idpCallback,
|
|
samlRootURL: samlRootURL,
|
|
assetAPIPrefix: assetAPIPrefix,
|
|
checkPermission: checkPermission,
|
|
}
|
|
}
|
|
|
|
func (s *Server) RegisterConnectServer(interceptors ...connect.Interceptor) (string, http.Handler) {
|
|
return userconnect.NewUserServiceHandler(s, connect.WithInterceptors(interceptors...))
|
|
}
|
|
|
|
func (s *Server) FileDescriptor() protoreflect.FileDescriptor {
|
|
return user.File_zitadel_user_v2beta_user_service_proto
|
|
}
|
|
|
|
func (s *Server) AppName() string {
|
|
return user.UserService_ServiceDesc.ServiceName
|
|
}
|
|
|
|
func (s *Server) MethodPrefix() string {
|
|
return user.UserService_ServiceDesc.ServiceName
|
|
}
|
|
|
|
func (s *Server) AuthMethods() authz.MethodMapping {
|
|
return user.UserService_AuthMethods
|
|
}
|
|
|
|
func (s *Server) RegisterGateway() server.RegisterGatewayFunc {
|
|
return user.RegisterUserServiceHandler
|
|
}
|