Repository navigation
Docs: OIDC resource server guide, Keycloak and Zitadel test environment (4/7) - #894
Merged
Merged
Conversation
… for configuration and plugins
…arty and scope checks
…etadata endpoints
… conditions, scheme always registered The derived audience and resource_metadata URL come from the store resolved for the request, never from the Host header. Resources with account conditions are refused until those checks exist. With the resource server disabled the Oidc scheme is still registered with no issuer and no keys, so endpoints naming it answer 401. authorization_servers publishes the Authority as configured, an http Authority requires RequireHttpsMetadata=false, garbage tokens log at Information, and the startup skips an uninstalled database.
…rified e-mail or registration
…e request through a request customer resolver
…fier (install and migration)
…back-office accounts; one identity per customer
…ration off by default
…OpenID Connect scheme
…ic tokens to the OpenID Connect scheme
…8 and Zitadel v4.19 Web API module flag, provider switch and identity links, Keycloak resource indicators accepted with the Audience mapper, Zitadel role assertion for user_grants, client_id instead of azp, project-wide aud, and the target reading user.human.is_email_verified.
…t, never the store cookie
…nt between host and resource path
…t without a resource URI
…thorization server metadata cannot be obtained
…ct identifier lookup
OIDC link records get an identifier derived from the customer (first 12 bytes of SHA-256 over the provider name and customer id), so the primary key rejects a second OIDC link for the same customer on MongoDB and LiteDB. A request that loses the race to another subject gets the linked-to-another-identity refusal instead of a second link.
… OIDC identity per customer enforced by the link id
…identity per customer enforced by the link id
…sults it forwarded to the Oidc scheme
…nstead of name prefixes
…g decision per request
… instead of repeating its rule
…isabled, before any customer is resolved
…ed resource by default
…tomer resolution, Deny defaults for the Web API
…s-e2e # Conflicts: # src/Business/Grand.Business.Core/Interfaces/Authentication/IJwtBearerAuthenticationService.cs # src/Business/Grand.Business.Core/Interfaces/Customers/IUserApiService.cs # src/Core/Grand.Domain/Customers/UserApi.cs # src/Web/Grand.Web/App_Data/appsettings.json
…mment names the Store URL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type: feature
Issue
Shop owners need to know how to configure the resource server with a real identity provider and how to test it. Part 4 of the OIDC stack (base: PR 3).
Solution
docs/oidc-resource-server.md: configuration reference, token-to-customer rules, errors and metadata, protecting a plugin's endpoints, step-by-step setup for Keycloak 26.8 and Zitadel v4.19, the introspection evaluation and the API users deprecation.docs/oidc/docker-compose.yml(test environment only) anddocs/oidc/zitadel-email-target.js(a Zitadel Actions v2 target that adds the e-mail claims to access tokens).Verified end to end on an app copy with Keycloak 26.8.0 and Zitadel v4.19.4 (authorization code + PKCE; the right token is accepted, a wrong audience or a missing scope is refused).
Breaking changes
None (documentation and test tooling).
Testing
/apiwith the obtained token as described, and check the refusal cases in section 4.1.