No Roles in JWT despite using claims
š¬Self-hostedāQuestionā
Solved
In my company, I'm developing MCP server which connects to our internal tools, so I need the server to know user's roles in the tools it calls. The problem is, even if I explicitly add the claim urn
iam:org:project:<toolA-project-id>:roles, I only keep getting roles from MCP project, where the app I authenticate my MCP server lives (even if I don't really need it). I tried checking all the checkboxes related to inserting roles off and on, and couldn't make the roles from any project (outside of the MCP project) appear in JWT. On the other hand, aud claims work perfectly fine - I get in aud whatever I ask for.
The workaround is to go with token exchange - I can create a separate app in a project for which I have the roles defined, but I'd had to rely on userinfo for roles instead of having them available in JWT right away, but I'd rather have a simpler setup, at least for now.
I double- and triple-checked that all the IDs are correct, I have roles defined in both projects, and both projects exist within the same org. Introspection and userinfo for the original token also don't return roles.
I'm using self-hosted Zitadel 4.14
iam:org:project:<toolA-project-id>:roles, I only keep getting roles from MCP project, where the app I authenticate my MCP server lives (even if I don't really need it). I tried checking all the checkboxes related to inserting roles off and on, and couldn't make the roles from any project (outside of the MCP project) appear in JWT. On the other hand, aud claims work perfectly fine - I get in aud whatever I ask for.The workaround is to go with token exchange - I can create a separate app in a project for which I have the roles defined, but I'd had to rely on userinfo for roles instead of having them available in JWT right away, but I'd rather have a simpler setup, at least for now.
I double- and triple-checked that all the IDs are correct, I have roles defined in both projects, and both projects exist within the same org. Introspection and userinfo for the original token also don't return roles.
I'm using self-hosted Zitadel 4.14
