feat(oidc): optimize the userinfo endpoint by muhlemmer · Pull Request #7706 · zitadel/zitadel

muhlemmer · 2024-04-04T13:12:17Z

Optimize the userinfo endpoint by reducing the amount of database queries.
Mostly reuses optimizations introduced by #6909. The legacy and trigger feature flags are also shared.

During implementation I found that the optimized introspection (and the new userinfo code from this PR) would always return the project roles, even if project_role_assertion was set to false. This is now fixed, however it seems that with v2 tokens with legacy userinfo & introspection never returned project roles if this setting was true. This bug was likely introduced with the v2 token implementation here:

zitadel/internal/api/oidc/auth_request.go

Lines 260 to 263 in d39b32a

    
           scopes, err := o.assertProjectRoleScopes(ctx, applicationID, req.GetScopes()) 
        
           if err != nil { 
        
           	return "", "", time.Time{}, zerrors.ThrowPreconditionFailed(err, "OIDC-Df2fq", "Errors.Internal") 
        
           }

This issue and how to handle should be discussed in review.

Closes #6910

Definition of Ready

vercel · 2024-04-04T13:12:24Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Apr 9, 2024 11:36am

This reverts commit 5f0262f.

When tokens were obtained using the client credentials grant, with audience and role scopes, userinfo would not return the role claims. This had multiple causes: 1. There is no auth request flow, so for legacy userinfo project data was never attached to the token 2. For optimized userinfo, there is no client ID that maps to an application. The client ID for client credentials is the machine user's name. There we can't obtain a project ID. When the project ID remained empty, we always ignored the roleAudience. This PR fixes situation 2, by always taking the roleAudience into account, even when the projectID is empty. The code responsible for the bug is also refactored to be more readable and understandable, including additional godoc. The fix only applies to the optimized userinfo code introduced in #7706 and released in v2.50 (currently in RC). Therefore it can't be back-ported to earlier versions. Fixes #6662

github-actions · 2024-04-15T15:11:32Z

🎉 This PR is included in version 2.50.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

* fix(oidc): roles in userinfo for client credentials token When tokens were obtained using the client credentials grant, with audience and role scopes, userinfo would not return the role claims. This had multiple causes: 1. There is no auth request flow, so for legacy userinfo project data was never attached to the token 2. For optimized userinfo, there is no client ID that maps to an application. The client ID for client credentials is the machine user's name. There we can't obtain a project ID. When the project ID remained empty, we always ignored the roleAudience. This PR fixes situation 2, by always taking the roleAudience into account, even when the projectID is empty. The code responsible for the bug is also refactored to be more readable and understandable, including additional godoc. The fix only applies to the optimized userinfo code introduced in #7706 and released in v2.50 (currently in RC). Therefore it can't be back-ported to earlier versions. Fixes #6662 * chore(deps): update all go deps (#7764) This change updates all go modules, including oidc, a major version of go-jose and the go 1.22 release. * Revert "chore(deps): update all go deps" (#7772) Revert "chore(deps): update all go deps (#7764)" This reverts commit 6893e7d. --------- Co-authored-by: Livio Spring <livio.a@gmail.com>

* fix(oidc): roles in userinfo for client credentials token When tokens were obtained using the client credentials grant, with audience and role scopes, userinfo would not return the role claims. This had multiple causes: 1. There is no auth request flow, so for legacy userinfo project data was never attached to the token 2. For optimized userinfo, there is no client ID that maps to an application. The client ID for client credentials is the machine user's name. There we can't obtain a project ID. When the project ID remained empty, we always ignored the roleAudience. This PR fixes situation 2, by always taking the roleAudience into account, even when the projectID is empty. The code responsible for the bug is also refactored to be more readable and understandable, including additional godoc. The fix only applies to the optimized userinfo code introduced in #7706 and released in v2.50 (currently in RC). Therefore it can't be back-ported to earlier versions. Fixes #6662 * chore(deps): update all go deps (#7764) This change updates all go modules, including oidc, a major version of go-jose and the go 1.22 release. * Revert "chore(deps): update all go deps" (#7772) Revert "chore(deps): update all go deps (#7764)" This reverts commit 6893e7d. --------- Co-authored-by: Livio Spring <livio.a@gmail.com> (cherry picked from commit 9ccbbe0)

* fix(oidc): roles in userinfo for client credentials token When tokens were obtained using the client credentials grant, with audience and role scopes, userinfo would not return the role claims. This had multiple causes: 1. There is no auth request flow, so for legacy userinfo project data was never attached to the token 2. For optimized userinfo, there is no client ID that maps to an application. The client ID for client credentials is the machine user's name. There we can't obtain a project ID. When the project ID remained empty, we always ignored the roleAudience. This PR fixes situation 2, by always taking the roleAudience into account, even when the projectID is empty. The code responsible for the bug is also refactored to be more readable and understandable, including additional godoc. The fix only applies to the optimized userinfo code introduced in zitadel#7706 and released in v2.50 (currently in RC). Therefore it can't be back-ported to earlier versions. Fixes zitadel#6662 * chore(deps): update all go deps (zitadel#7764) This change updates all go modules, including oidc, a major version of go-jose and the go 1.22 release. * Revert "chore(deps): update all go deps" (zitadel#7772) Revert "chore(deps): update all go deps (zitadel#7764)" This reverts commit 6893e7d. --------- Co-authored-by: Livio Spring <livio.a@gmail.com> (cherry picked from commit 1069c92)

feat(oidc): optimize the userinfo endpoint

25a2cd4

vercel Bot deployed to Preview April 4, 2024 13:19 View deployment

muhlemmer added 2 commits April 4, 2024 18:52

store project ID in the access token

5f0262f

query for projectID if not in token

ce47e4c

vercel Bot deployed to Preview April 4, 2024 16:33 View deployment

add scope based tests

229c7a6

vercel Bot deployed to Preview April 5, 2024 11:42 View deployment

Revert "store project ID in the access token"

ec51dda

This reverts commit 5f0262f.

vercel Bot deployed to Preview April 8, 2024 08:38 View deployment

muhlemmer added 2 commits April 8, 2024 14:17

query project role assertion

efcba64

Merge branch 'main' into perf-userinfo

d39b32a

vercel Bot deployed to Preview April 8, 2024 13:00 View deployment

use project role assertion setting to return roles

463d6ca

vercel Bot deployed to Preview April 8, 2024 13:31 View deployment

muhlemmer marked this pull request as ready for review April 8, 2024 13:35

muhlemmer requested a review from livio-a April 8, 2024 13:36

livio-a reviewed Apr 9, 2024

View reviewed changes

Comment thread internal/api/oidc/userinfo.go Outdated

workaround eventual consistency and handle PAT

fc9e9a2

vercel Bot deployed to Preview April 9, 2024 09:28 View deployment

do not append empty project id

ed8e636

vercel Bot deployed to Preview April 9, 2024 10:00 View deployment

muhlemmer requested a review from livio-a April 9, 2024 11:28

muhlemmer enabled auto-merge (squash) April 9, 2024 11:28

Merge branch 'main' into perf-userinfo

0ced5a1

vercel Bot deployed to Preview April 9, 2024 11:36 View deployment

livio-a approved these changes Apr 9, 2024

View reviewed changes

muhlemmer merged commit 6a51c4b into main Apr 9, 2024

muhlemmer deleted the perf-userinfo branch April 9, 2024 13:15

muhlemmer mentioned this pull request Apr 13, 2024

fix(oidc): roles in userinfo for client credentials token #7763

Merged

13 tasks done

github-actions Bot added the released label Apr 15, 2024

muhlemmer mentioned this pull request Jun 18, 2024

Cleanup legacy introspection and userinfo #8153

Open

4 tasks

Navigation Menu

feat(oidc): optimize the userinfo endpoint - #7706

feat(oidc): optimize the userinfo endpoint#7706
muhlemmer merged 11 commits into
mainfrom
perf-userinfo

muhlemmer commented Apr 4, 2024 •

edited

Loading

Uh oh!

vercel Bot commented Apr 4, 2024 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Apr 15, 2024

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	scopes, err := o.assertProjectRoleScopes(ctx, applicationID, req.GetScopes())
	if err != nil {
	return "", "", time.Time{}, zerrors.ThrowPreconditionFailed(err, "OIDC-Df2fq", "Errors.Internal")
	}

Conversation

muhlemmer commented Apr 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Definition of Ready

Uh oh!

vercel Bot commented Apr 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 15, 2024

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

muhlemmer commented Apr 4, 2024 •

edited

Loading

vercel Bot commented Apr 4, 2024 •

edited

Loading