User authentication using zitadel end points

[satishviswanathan]

I'm new to Zitadel and still trying to figure out different concepts. I have the following set up.

1. Created an Organization.
2. Created a API project.
3. Created a regular user with User name and Password.
4. Assigned a Role and mapped to API project

My need is to authenticate a user against a project.

I'm trying to use the oauth/v2/token and passed the client_id ,client_secret, grant_type (client_credentials) and passed the scope as openid profile email urn:zitadel:iam:org:project:id:5467856.

I'm assume the approach might be wrong but the idea was to get the user authenticated against the project id.

I see an end point oauth/v2/introspect should I use this end point for this. I tried this as well but couldn't get it working.

Any help on this is appreciated

[dakshitha]

What is your use case scenario?

If you want to invoke the API with a token, your regular/human user will have to authenticate themselves via a front-facing app like a web app/native app/mobile app and obtain a token. This token can then be used to invoke the API, which in turn will call the introspection endpoint to see if the token is valid and grant access to the API. If you want the user to be authenticated, you need to create a web app (or native app/mobile app) in the project. This will prompt the user to log in. If you only want to test the API or get a program to invoke the API, you need to get a token to do that. For that, you can create a service user and generate a token via client credentials of that service user or use a personal access token (PAT) that can be generated by ZITADEL as an access token.

You can get an idea about the different scenarios via these blog posts:

https://zitadel.com/blog/secure-logins-with-zitadel-part-1
https://zitadel.com/blog/secure-logins-with-zitadel-part-2
https://zitadel.com/blog/api-access-and-introspection

[satishviswanathan]

@dakshitha - Thank you for providing a detail explanation. The current use case is to validate the token generated via a UI workflow. The need is to validate the token each time an API is invoked. As I mentioned I'm still trying to figure out how it works and what I'm trying to achieve here is authenticate a user by calling oauth/v2/token and then call the introspect end point. I don't have the UI project integrated with Zitadel , since would like to see if there is an option to generate a token via calling zitadel token end point and then have ensure if the user has access to this API project.

[dakshitha]

Ok. The links I provided cover these steps. You can authenticate your users via the UI and take the token and send it when calling the backend API. If you want an end-to-end scenario, this would be helpful too -

https://zitadel.com/docs/guides/solution-scenarios/frontend-calling-backend-API

[satishviswanathan]

@dakshitha - Using the following blog I was trying to authenticate against a UI app.

https://zitadel.com/blog/secure-logins-with-zitadel-part-2

However as shown in step 2.3.2 I didn't get the Zitadel screen where the user is prompted with the login screen instead I got the Authorization code and PKCE result. Am I missing anything here?

Zitadel version : v2.38.2

[dakshitha]

You must be already logged in to ZITADEL if you don't see a login screen.

[satishviswanathan]

@dakshitha Thank you that worked, I didn't notice that :) I have mostly used Keycloak and trying to figure out how this works.

I got the token from my UI app using the OIDC debugger and following the given below link to call the introspect url.

https://zitadel.com/blog/api-access-and-introspection

I've send the following data

client_assertion_type
client_assertion
token
code

I'm getting the following error

"ErrorType=unauthorized_client Description=JWT assertion failed Parent=audience is not valid: Audience must contain client_id <Zitadel_URL>"

Any idea what I could be missing here.

[dakshitha]

Are you trying the JWT profile for the token introspection in the API? Make sure that you include your client_id as shown below in the payload and that audience is set to your ZITADEL domain.

def introspect_token(self, token_string):
    #Create JWT for client assertion
    payload = {
        "iss": API_PRIVATE_KEY_FILE["client_id"],
        "sub": API_PRIVATE_KEY_FILE["client_id"],
        "aud": ZITADEL_DOMAIN,
        "exp": int(time.time()) + 60 * 60,  # Expires in 1 hour
        "iat": int(time.time())
    }
    headers = {
        "alg": "RS256",
        "kid": API_PRIVATE_KEY_FILE["key_id"]
    }
    jwt_token = jwt.encode(payload, API_PRIVATE_KEY_FILE["private_key"], algorithm="RS256", headers=headers)

    #Send introspection request
    headers = {"Content-Type": "application/x-www-form-urlencoded"}
    data = {
        "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
        "client_assertion": jwt_token,
        "token": token_string
    }
    response = requests.post(ZITADEL_INTROSPECTION_URL, headers=headers, data=data)
    response.raise_for_status()
    token_data = response.json()
    print(f"Token data from introspection: {token_data}")
    return token_data

[satishviswanathan]

Following the steps in the links given below.

https://zitadel.com/blog/api-access-and-introspection

I did a curl to introspect end point.

curl --request POST
--url {your_domain}/oauth/v2/introspect
--header 'Content-Type: application/x-www-form-urlencoded'
--data client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
--data client_assertion=eyJhbGciOiJSUzI1Ni...
--data token=VjVxyCZmRmWYqd3_F5db9Pb9mHR

[dakshitha]

For the client_assertion, did you create the JWT with the client id, audience etc. (as shown in the code I added earlier)?

[satishviswanathan]

@dakshitha Thank you, yes I did that but I was using jwt.io which had a default private key. I replaced that with the private key of my api application and now I'm always getting response as active "false".

[dakshitha]

I think you followed https://zitadel.com/blog/secure-logins-with-zitadel-part-2 to generate the user token right? Since the post doesn't cover token introspection, it doesn't include a scope that you must send with the initial request to get the token.

The scope is - urn:zitadel:iam:org:project:id:{your_projectid}:aud (add it along with openid email in the scope field in the OIDC Debugger)

We add the same scope for service users in this post when obtaining tokens for for token introspection - https://zitadel.com/blog/api-access-and-introspection#41-obtaining-an-access-token-via-the-zitadel-token-endpoint

[satishviswanathan]

@dakshitha Thank you. I have added the following to the scope for the token end point while calling from OIDC debugger

urn:zitadel:iam:org:project:id:{your_projectid}.

What I'm trying achieve is, since I'm not using the actual UI app for getting my token I would be using the OIDC debugger to get the token, then call the introspect end point for checking if the same user has permission to API application. During this testing process as of now I'm not using a service account user instead I'm using my LDAP account. Hope that scenario works.

Sample payload from OIDC debugger

https://{your_domain}/oauth/v2/authorize
?client_id=<UI_APP_CLIENT_ID>@vite_platform
&redirect_uri=https://oidcdebugger.com/debug
&scope=openid email profile urn:zitadel:iam:org:project:id:<Project_id>:aud read:messages
&response_type=code
&response_mode=query
&code_challenge_method=S256
&code_challenge=<challenge_code>
&state=varl3k05uhk
&nonce=gi7rwx1y3b9

curl --request POST
--url {your_domain}/oauth/v2/introspect
--header 'Content-Type: application/x-www-form-urlencoded'
--data client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
--data client_assertion=eyJhbGciOiJSUzI1Ni...
--data token=VjVxyCZmRmWYqd3_F5db9Pb9mHR
--scope=openid email profile urn:zitadel:iam:org:project:id:<Project_id>:aud read:messages

[satishviswanathan]

@dakshitha thank you for your help , I got it working.

I assume roles and permission at project level and it's applicable for all applications under it.

[dakshitha]

Super! You're welcome :)

Yes, that's right.