Repository navigation
Web API: accept identity provider tokens next to the API-user JWT (3/7) - #893
Merged
Merged
Conversation
… for configuration and plugins
…arty and scope checks
…etadata endpoints
… conditions, scheme always registered The derived audience and resource_metadata URL come from the store resolved for the request, never from the Host header. Resources with account conditions are refused until those checks exist. With the resource server disabled the Oidc scheme is still registered with no issuer and no keys, so endpoints naming it answer 401. authorization_servers publishes the Authority as configured, an http Authority requires RequireHttpsMetadata=false, garbage tokens log at Information, and the startup skips an uninstalled database.
…rified e-mail or registration
…e request through a request customer resolver
…fier (install and migration)
…back-office accounts; one identity per customer
…ration off by default
…OpenID Connect scheme
…ic tokens to the OpenID Connect scheme
…t, never the store cookie
…nt between host and resource path
…t without a resource URI
…thorization server metadata cannot be obtained
…ad of failing the request
…he startup that maps them
…source URI validation
…-store OIDC links
…-store OIDC links
…ct identifier lookup
OIDC link records get an identifier derived from the customer (first 12 bytes of SHA-256 over the provider name and customer id), so the primary key rejects a second OIDC link for the same customer on MongoDB and LiteDB. A request that loses the race to another subject gets the linked-to-another-identity refusal instead of a second link.
… OIDC identity per customer enforced by the link id
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
KrzysztofPajak
commented
Oct 11, 2026
…sults it forwarded to the Oidc scheme
…nstead of name prefixes
…g decision per request
… instead of repeating its rule
…isabled, before any customer is resolved
…ed resource by default
KrzysztofPajak
added a commit
that referenced
this pull request
Oct 11, 2026
Member
Author
|
Review fixes: All ten review findings are fixed on
Two points differ from the review:
The three generic catches became one filtered catch over the three exception types the parser throws. The guide on #894 now covers algorithm-only routing, the earlier kill switch and the Deny defaults. Nothing is left open. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type: feature
Issue
Grand.Module.Apionly accepts GrandNode's own JWT. It must also accept identity-provider tokens without breaking existing integrations. Part 3 of the OIDC stack (base: PR 2).Solution
OidcSchemeSelectorforwards a Bearer request to theOidcscheme when the token is the provider's (issuer equals the Authority, an asymmetric algorithm, or no readable JWT); the existing JWT keeps its scheme. A bearer value that is not a JWT is treated as no token.AuthorizeApiAdminFilterrefuses every scheme whenBackendAPIis disabled (before, this was enforced only for the legacy JWT)./apiis configured as a protected resource in appsettings (off with the rest of the feature).UserApi,IUserApiServiceandIJwtBearerAuthenticationServiceare marked[Obsolete]; the admin API users page shows a deprecation notice (resource in DefaultLanguage.xml anden_250.xml, 2.5 migration).Breaking changes
None for running integrations: the legacy API-user JWT still works. Plugin code using the types above now gets obsolete warnings.
Testing
dotnet test src/Tests/Grand.Module.Api.Testsanddotnet test src/Tests/Grand.Web.Common.Tests- all pass./api/...still answers 200.docs/oidc-resource-server.mdsections 6/7 (PR 4): right audience and scope give 200; a wrong audience or a missing scope give 401/403 withWWW-Authenticate.