mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-12 00:55:12 +00:00
Max PeintnerandGitHub
790244dd49
# Which Problems Are Solved - Logins through the new login via a Zitadel identity provider with `instanceRolesInfo` configured (e.g. support access) create/update the user, but the instance member roles from the `urn:zitadel:iam:org:project:roles` claim are never assigned — that synchronization only exists in the login v1 flow. Support users therefore end up without any permissions. # How the Problems Are Solved - New `syncInstanceRolesFromIdpIntent` in the login, called after user auto-creation and on existing-user logins. It mirrors the v1 filtering: roles are only honored for ZITADEL IdPs with `instanceRolesInfo`, when granted in a configured organization (matched on ID and domain) and using an instance role key (`IAM_` prefix). Memberships are written merge-only via the v2 `InternalPermissionService` (existing roles are never removed), and a failed sync logs a warning without blocking the login. # Additional Changes - Unit tests for the claim-to-role filtering. # Additional Context - Part of the "ZITADEL as an Identity Provider" epic: #5127 - Follow-up for PR #xxx (ZITADEL provider sign-in button in the new login)
50 lines
2.2 KiB
TypeScript
50 lines
2.2 KiB
TypeScript
import { createClientFor } from "@zitadel/client";
|
|
import { IdentityProviderService } from "@zitadel/proto/zitadel/idp/v2/idp_service_pb";
|
|
import { InternalPermissionService } from "@zitadel/proto/zitadel/internal_permission/v2/internal_permission_service_pb";
|
|
import { OIDCService } from "@zitadel/proto/zitadel/oidc/v2/oidc_service_pb";
|
|
import { OrganizationService } from "@zitadel/proto/zitadel/org/v2/org_service_pb";
|
|
import { SAMLService } from "@zitadel/proto/zitadel/saml/v2/saml_service_pb";
|
|
import { SessionService } from "@zitadel/proto/zitadel/session/v2/session_service_pb";
|
|
import { SettingsService } from "@zitadel/proto/zitadel/settings/v2/settings_service_pb";
|
|
import { UserService } from "@zitadel/proto/zitadel/user/v2/user_service_pb";
|
|
import { loginClientKeyToken, systemAPIToken } from "./api";
|
|
import { hasLoginClientKey, hasServiceUserToken, hasSystemUserCredentials } from "./deployment";
|
|
import { createServerTransport, ServiceConfig } from "./zitadel";
|
|
|
|
type ServiceClass =
|
|
| typeof IdentityProviderService
|
|
| typeof UserService
|
|
| typeof OrganizationService
|
|
| typeof SessionService
|
|
| typeof OIDCService
|
|
| typeof SettingsService
|
|
| typeof SAMLService
|
|
| typeof InternalPermissionService;
|
|
|
|
export async function createServiceForHost<T extends ServiceClass>(service: T, serviceConfig: ServiceConfig) {
|
|
let token;
|
|
|
|
// Determine authentication method based on available credentials
|
|
// Priority: system user JWT > login client key > service account token
|
|
if (hasSystemUserCredentials()) {
|
|
token = await systemAPIToken();
|
|
} else if (hasLoginClientKey()) {
|
|
token = await loginClientKeyToken();
|
|
} else if (hasServiceUserToken()) {
|
|
// Use service account token authentication (self-hosted)
|
|
token = process.env.ZITADEL_SERVICE_USER_TOKEN;
|
|
} else {
|
|
throw new Error(
|
|
"No authentication credentials found. Set ZITADEL_LOGINCLIENT_KEYFILE, or system user credentials (AUDIENCE, SYSTEM_USER_ID, SYSTEM_USER_PRIVATE_KEY or SYSTEM_USER_PRIVATE_KEY_FILE), or ZITADEL_SERVICE_USER_TOKEN",
|
|
);
|
|
}
|
|
|
|
if (!serviceConfig) {
|
|
throw new Error("No service config found");
|
|
}
|
|
|
|
const transport = createServerTransport(token, serviceConfig);
|
|
|
|
return createClientFor<T>(service)(transport);
|
|
}
|