Getting grants across organization boundary
āļøConfigurationš¬Self-hostedš¬Roles & PermissionsāQuestionšOIDC
Hi all,
I have this resource setup:
The user logs in using the Web-Interface I wrote using Vue and the
I then pass the
The token introspection does not return the Grant of
If I add the scope
Also, if I pass that token to the API and from there to the token inspection endpoint, although the scope gets shown, the grant is not.
Am I missing something very obvious?
I have this resource setup:
The user logs in using the Web-Interface I wrote using Vue and the
zitadel-vuezitadel-vue library.I then pass the
accessTokenaccessToken to the API I wrote using FastAPI and the validator from the documentation.The token introspection does not return the Grant of
aa to the user from OrgA/ProjectA-A. How can I achieve that?If I add the scope
urn:zitadel:iam:org:project:id:<A-A>:audurn:zitadel:iam:org:project:id:<A-A>:aud to the oidcAuth in the Vue-App, the grant is returned in the userinfo as shown in the Vue example. This does not scale, though, as I would need to add all projects to the list of scopes to get a complete view of the users' grants.Also, if I pass that token to the API and from there to the token inspection endpoint, although the scope gets shown, the grant is not.
Am I missing something very obvious?
