Zitadel and oauth2-proxy, restricting access with roles

[lordpayder]

Hi,
I'm currently setting up Zitadel as idp for Traefik and oauth2-proxy.
Following the guide I added the required action to get an array with roles to restrict access with "allowed_groups".

I'm starting oauth2-proxy with the command "--oidc-groups-claim=my:zitadel:grants" (tutorial only said something about "your_actions_group_key", hope that's it) but the /oauth2/userinfo endpoint of oauth2-proxy only shows

{"user":"228141238493118466","email":"test@justatest.asdf","preferredUsername":"test@justatest.asdf"}

After changing --oidc-groups-claim to urn:zitadel:iam:org:project:roles I see roles added to the token, but it's not the desired format

{"user":"228141238493118466","email":"test@justatest.asdf","groups":["{\"access\":{\"227849250375991298\":\"zitadel.auth.domain.tld\"},\"helloworld\":{\"227849250375991298\":\"zitadel.auth.domain.tld\"}}"],"preferredUsername":"test@justatest.asdf"}

I see the event "Access token created" with the following content

{
  "applicationId": "227853396177125379@oauth2-proxy",
  "audience": [
    "227853396177125379@oauth2-proxy",
    "227851229449945091"
  ],
  "expiration": "2023-08-20T10:07:41.155131596Z",
  "preferredLanguage": "und",
  "scopes": [
    "openid",
    "email",
    "profile",
    "urn:zitadel:iam:org:project:role:access",
    "urn:zitadel:iam:org:project:role:helloworld"
  ],
  "tokenId": "228148094267555842",
  "userAgentId": "227943642130546691"
}

---

[lordpayder]

I tried a few more things and added a few logs to the action. Seems like ctx.v1.user.grants in the action is always undefined but I don't know why. Any tips what I'm doing wrong?

Updated action:

/**
 * sets the roles an additional claim in the token with roles as value an project as key
 * 
 * The role claims of the token look like the following:
 * 
 * // added by the code below
 * "my:zitadel:grants": ["{projectId}:{roleName}", "{projectId}:{roleName}", ...],
 * // added automatically
 * "urn:zitadel:iam:org:project:roles": {
 *   "asdf": {
 *     "201982826478953724": "zitadel.localhost"
 *   }
 * }
 *
 * Flow: Complement token, Triggers: Pre Userinfo creation, Pre access token creation
 *
 * @param ctx
 * @param api
 */
let logger = require("zitadel/log")

function flatRoles(ctx, api) {
  logger.log("first line in function");
  
  if (ctx.v1.user == undefined) {
    logger.log("ctx.v1.user == undefined");
    return;
  }
  
  if (ctx.v1.user.grants == undefined) {
    logger.log("ctx.v1.user.grants == undefined");
    return;
  }
  
  if (ctx.v1.user.grants.count == 0) {
    logger.log("ctx.v1.user.grants.count == 0");
    return;
  }

  logger.log("if conditions passed");
  api.v1.claims.setClaim('my:zitadel:test', ["helloworld"])
  let grants = [];
  ctx.v1.user.grants.grants.forEach(claim => {
    claim.roles.forEach(role => {
        grants.push(claim.projectId+':'+role)  
    })
  })

  api.v1.claims.setClaim('my:zitadel:grants', grants)
}

---

Logs:

docker-compose logs -f | grep "log record emitted"
record="{\"logDate\":\"2023-08-20T16:48:45.977090818Z\",\"took\":0,\"message\":\"action run started\",\"logLevel\":\"info\",\"instanceId\":\"227849250359214082\"}"
record="{\"logDate\":\"2023-08-20T16:48:45.977295707Z\",\"took\":0,\"message\":\"first line in function\",\"logLevel\":\"info\",\"instanceId\":\"227849250359214082\"}"
record="{\"logDate\":\"2023-08-20T16:48:45.977320604Z\",\"took\":0,\"message\":\"ctx.v1.user.grants == undefined\",\"logLevel\":\"info\",\"instanceId\":\"227849250359214082\"}"       
record="{\"logDate\":\"2023-08-20T16:48:45.977329679Z\",\"took\":238863,\"message\":\"action run succeeded\",\"logLevel\":\"info\",\"instanceId\":\"227849250359214082\"}"
record="{\"logDate\":\"2023-08-20T16:48:46.029626269Z\",\"took\":0,\"message\":\"action run started\",\"logLevel\":\"info\",\"instanceId\":\"227849250359214082\"}"
record="{\"logDate\":\"2023-08-20T16:48:46.029770604Z\",\"took\":0,\"message\":\"first line in function\",\"logLevel\":\"info\",\"instanceId\":\"227849250359214082\"}"
record="{\"logDate\":\"2023-08-20T16:48:46.029792818Z\",\"took\":0,\"message\":\"ctx.v1.user.grants == undefined\",\"logLevel\":\"info\",\"instanceId\":\"227849250359214082\"}"       
record="{\"logDate\":\"2023-08-20T16:48:46.029801146Z\",\"took\":174884,\"message\":\"action run succeeded\",\"logLevel\":\"info\",\"instanceId\":\"227849250359214082\"}"

[lordpayder]

Solved.. 😏
ghcr.io/zitadel/zitadel:stable → latest