Documentation corrections

[MajaEffenberg]

During the implementation of Zidatel in our project, I noticed some unclear descriptions and missing information in the documentation:

1. I ran into a problem in Quickstarts Angular while calling auth.getOIDCUser() (error: Cannot read property 'toLowerCase' of null), to solve this I had to add in authConfig additional field userinfoEndpoint: https://api.zitadel.ch/oauth/v2/userinfo. I think it would be good to include this additional information in the documentation.
2. I also had a problem with finding the audience of the project's application to verify the token of the logged in user in the backend (Node.js).
3. Unclear OAuth token request documentation for Service Users. In the documentation in the section: Request an OAuth token, with audience for ZITADEL, the information about grant_type says that it must be set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer, but in this case I get an error: 'grant_type not supported'. However, the correct grant_type that works is urn:ietf:params:oauth:grant-type:jwt-bearer and can be found in the documentation of the Service Users.

I hope this will help to improve the documentation.

[livio-a]

Hi @MajaEffenberg

Thanks for reaching out.

@peintnermax can you have a look at number 1, please?

I thought we've had number 3 fixed already, but I'll sort it out. client-assertion-type is for authenticating a client (not service user).
And I see that there are guides and documentation missing for backends / APIs. I'll check with my colleagues today.

[livio-a]

wrong grant_type docs will be fixed with #2227

[MajaEffenberg]

Thank you for the information and including this in the documentation

[peintnermax]

Hi @MajaEffenberg

did you set oidc:true in your AuthConfig? oidc true should tell the library to get the userinfo endpoint from the discovery endpoint at .well-known/openid-configuration. As you can see in our service we don't specify the userinfoEndpoint.
https://github.com/caos/zitadel/blob/main/console/src/app/services/grpc.service.ts#L64

[MajaEffenberg]

Hi @peintnermax

I saw that in the link above you do not specify dummyClientSecret in AuthConfig, as noted in the Angular quickstarts documentation. After removing this property, the problem with auth.getOIDCUser() no longer appears and I don't need to set userinfoEndpoint.

[peintnermax]

Your right. Client secret doesn't make any sense here. It will be removed from our quickstarts with zitadel/zitadel-examples#42 and #2257. Thank you for your feedback 👍