Scoping to specific organization in JWT token
Hi there,
I'm currently running Zitadel 4.2.7 self-hosted as the main authentication platform for a SaaS application. The application consists of a single-page frontend and a backend server.
I have configured the ZItadel instance as follows:
* Under the default organization, MainCorp, internal users are added. This is also where a project and clients that are used by the application are defined - one of the clients is for the web authentication flow.
* Internal users have the role
* For customers, we create a new organization, and grant the MainCorp project to them. When we go to add a user for the customer organization, we can add the role
How this is implemented is that upon sign-in, the frontend app specifies the
(cont'd)
I'm currently running Zitadel 4.2.7 self-hosted as the main authentication platform for a SaaS application. The application consists of a single-page frontend and a backend server.
I have configured the ZItadel instance as follows:
* Under the default organization, MainCorp, internal users are added. This is also where a project and clients that are used by the application are defined - one of the clients is for the web authentication flow.
* Internal users have the role
corp:admincorp:admin, which is a special role that allows for admin tasks in the application, but nothing specific for customer organizations.* For customers, we create a new organization, and grant the MainCorp project to them. When we go to add a user for the customer organization, we can add the role
org:adminorg:admin or org:userorg:user to them. This will allow the customer to sign in and use the application.How this is implemented is that upon sign-in, the frontend app specifies the
web profile email offline_access urn:zitadel:iam:org:project:id:zitadel:audweb profile email offline_access urn:zitadel:iam:org:project:id:zitadel:aud scope, and gets a JWT token with a urn:zitadel:iam:org:project:rolesurn:zitadel:iam:org:project:roles key on successful authentication. At present the application doesn't care about multiple projects or client applications, as we only have the one defined. The token is then used in backend requests, and after verifying the signature, the backend will determine the organization to use and available roles from the first organization key within the specific role. This currently works since we don't grant more than one organization to a user. The reason I have done this is because, with short expiry times on tokens, this means the backend does not need to contact the Zitadel instance on every request to verify the token, nor store any secrets or private keys (except for the JWT public key store which can be downloaded from Zitadel and updated periodically if required).(cont'd)
