You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
chore: consistent naming for organization domain (zitadel#11356)
# Which Problems Are Solved
As part of the consistent naming effort, this PR focuses on
"Organization domain".
# How the Problems Are Solved
- All terms referring referring to Organization Domains where changed to
be Organization Domain
# Additional Changes
None
# Additional Context
- closes [zitadel#11283](zitadel#11283)
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
| urn:zitadel:iam:action:\{actionname}:log |`{"urn:zitadel:iam:action:appendCustomClaims:log": ["test log", "another test log"]}`| This claim is set during Actions as a log, e.g. if two custom claims with the same keys are set. |
112
-
| urn:zitadel:iam:org:domain:primary:\{domainname} |`{"urn:zitadel:iam:org:domain:primary": "acme.ch"}`| This claim represents the primary domain of the organization the user belongs to. |
112
+
| urn:zitadel:iam:org:domain:primary:\{domainname} |`{"urn:zitadel:iam:org:domain:primary": "acme.ch"}`| This claim represents the Organization Domain the user belongs to. |
113
113
| urn:zitadel:iam:org:project:roles |`{"urn:zitadel:iam:org:project:roles": [ {"user": {"id1": "acme.zitade.ch", "id2": "caos.ch"} } ] }`| When roles are asserted, ZITADEL does this by providing the `id` and `primaryDomain` below the role. This gives you the option to check in which organization a user has the role on the current project (where your application belongs to). |
114
114
| urn:zitadel:iam:org:project:\{projectid}:roles |`{"urn:zitadel:iam:org:project:id3:roles": [ {"user": {"id1": "acme.zitade.ch", "id2": "caos.ch"} } ] }`| When roles are asserted, ZITADEL does this by providing the `id` and `primaryDomain` below the role. This gives you the option to check in which organization a user has the role on a specific project. |
115
115
| urn:zitadel:iam:user:metadata |`{"urn:zitadel:iam:user:metadata": [ {"key": "VmFsdWU=" } ] }`| The metadata claim will include all metadata of a user. The values are base64 encoded. |
116
116
| urn:zitadel:iam:user:resourceowner:id |`{"urn:zitadel:iam:user:resourceowner:id": "orgid"}`| This claim represents the user's organization ID. |
117
117
| urn:zitadel:iam:user:resourceowner:name |`{"urn:zitadel:iam:user:resourceowner:name": "ACME"}`| This claim represents the user's organization's name. |
118
-
| urn:zitadel:iam:user:resourceowner:primary_domain |`{"urn:zitadel:iam:user:resourceowner:primary_domain": "acme.ch"}`| This claim represents the user's organization's primary domain. |
118
+
| urn:zitadel:iam:user:resourceowner:primary_domain |`{"urn:zitadel:iam:user:resourceowner:primary_domain": "acme.ch"}`| This claim represents the user's Organization Domain. |
|`urn:zitadel:iam:org:project:role:{rolekey}`|`urn:zitadel:iam:org:project:role:user`| By using this scope a client can request the claim `urn:zitadel:iam:org:project:roles` to be asserted when possible. As an alternative approach you can enable all roles to be asserted from the [project](/guides/manage/console/roles#role-assignments) a client belongs to. |
26
-
|`urn:zitadel:iam:org:projects:roles`|`urn:zitadel:iam:org:projects:roles`| By using this scope a client can request the claim `urn:zitadel:iam:org:project:{projectid}:roles` to be asserted for each requested project. All projects of the token audience, requested by the `urn:zitadel:iam:org:project:id:{projectid}:aud` scopes will be used. |
27
-
|`urn:zitadel:iam:org:id:{id}`|`urn:zitadel:iam:org:id:178204173316174381`| When requesting this scope **ZITADEL** will enforce that the user is a member of the selected organization. If the organization does not exist a failure is displayed. It will assert the `urn:zitadel:iam:user:resourceowner` claims. |
28
-
|`urn:zitadel:iam:org:domain:primary:{domainname}`|`urn:zitadel:iam:org:domain:primary:acme.ch`| When requesting this scope **ZITADEL** will enforce that the user is a member of the selected organization and the username is suffixed by the provided domain. If the organization does not exist a failure is displayed |
29
-
|`urn:zitadel:iam:org:roles:id:{orgID}`|`urn:zitadel:iam:org:roles:id:178204173316174381`| This scope can be used one or more times to limit the granted organization IDs in the returned roles. Unknown organization IDs are ignored. When this scope is not used, all granted organizations are returned inside the roles. |
30
-
|`urn:zitadel:iam:org:project:id:{projectid}:aud`|`urn:zitadel:iam:org:project:id:69234237810729019:aud`| By adding this scope, the requested project id will be added to the audience of the access token |
31
-
|`urn:zitadel:iam:org:project:id:zitadel:aud`|`urn:zitadel:iam:org:project:id:zitadel:aud`| By adding this scope, the ZITADEL project id will be added to the audience of the access token |
32
-
|`urn:zitadel:iam:user:metadata`|`urn:zitadel:iam:user:metadata`| By adding this scope, the metadata of the user will be included in the token. The values are base64 encoded. |
33
-
|`urn:zitadel:iam:user:resourceowner`|`urn:zitadel:iam:user:resourceowner`| By adding this scope: id, name and primary_domain of the user's organization will be included in the token. |
34
-
|`urn:zitadel:iam:org:idp:id:{idp_id}`|`urn:zitadel:iam:org:idp:id:76625965177954913`| By adding this scope the user will directly be redirected to the identity provider to authenticate. Make sure you also send the primary domain scope if a custom login policy is configured. Otherwise the system will not be able to identify the identity provider.|
|`urn:zitadel:iam:org:project:role:{rolekey}`|`urn:zitadel:iam:org:project:role:user`| By using this scope a client can request the claim `urn:zitadel:iam:org:project:roles` to be asserted when possible. As an alternative approach you can enable all roles to be asserted from the [project](/guides/manage/console/roles#role-assignments) a client belongs to. |
26
+
|`urn:zitadel:iam:org:projects:roles`|`urn:zitadel:iam:org:projects:roles`| By using this scope a client can request the claim `urn:zitadel:iam:org:project:{projectid}:roles` to be asserted for each requested project. All projects of the token audience, requested by the `urn:zitadel:iam:org:project:id:{projectid}:aud` scopes will be used. |
27
+
|`urn:zitadel:iam:org:id:{id}`|`urn:zitadel:iam:org:id:178204173316174381`| When requesting this scope **ZITADEL** will enforce that the user is a member of the selected organization. If the organization does not exist a failure is displayed. It will assert the `urn:zitadel:iam:user:resourceowner` claims. |
28
+
|`urn:zitadel:iam:org:domain:primary:{domainname}`|`urn:zitadel:iam:org:domain:primary:acme.ch`| When requesting this scope **ZITADEL** will enforce that the user is a member of the selected organization and the username is suffixed by the provided domain. If the organization does not exist a failure is displayed |
29
+
|`urn:zitadel:iam:org:roles:id:{orgID}`|`urn:zitadel:iam:org:roles:id:178204173316174381`| This scope can be used one or more times to limit the granted organization IDs in the returned roles. Unknown organization IDs are ignored. When this scope is not used, all granted organizations are returned inside the roles. |
30
+
|`urn:zitadel:iam:org:project:id:{projectid}:aud`|`urn:zitadel:iam:org:project:id:69234237810729019:aud`| By adding this scope, the requested project id will be added to the audience of the access token |
31
+
|`urn:zitadel:iam:org:project:id:zitadel:aud`|`urn:zitadel:iam:org:project:id:zitadel:aud`| By adding this scope, the ZITADEL project id will be added to the audience of the access token |
32
+
|`urn:zitadel:iam:user:metadata`|`urn:zitadel:iam:user:metadata`| By adding this scope, the metadata of the user will be included in the token. The values are base64 encoded. |
33
+
|`urn:zitadel:iam:user:resourceowner`|`urn:zitadel:iam:user:resourceowner`| By adding this scope: id, name and primary_domain of the user's organization will be included in the token. |
34
+
|`urn:zitadel:iam:org:idp:id:{idp_id}`|`urn:zitadel:iam:org:idp:id:76625965177954913`| By adding this scope the user will directly be redirected to the identity provider to authenticate. Make sure you also send the Organization Domain scope if a custom login policy is configured. Otherwise the system will not be able to identify the identity provider. |
Copy file name to clipboardExpand all lines: apps/docs/content/concepts/features/identity-brokering.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -57,7 +57,7 @@ For example some organizations might use their EntraID, some other want to log i
57
57
Using an identity provider with strong multitenancy capabilities such as ZITADEL, you can configure a different set of external identity providers per organization.
58
58
59
59
[Domain discovery](/guides/solution-scenarios/domain-discovery) ensures that users are redirected to their external identity provider based on their email-address or username.
60
-
[Administrators](../structure/administrators) can configure organization domains that are used for domain-based redirection to an external IdP.
60
+
[Administrators](../structure/administrators) can configure Organization Domains that are used for domain-based redirection to an external IdP.
Copy file name to clipboardExpand all lines: apps/docs/content/guides/integrate/login/hosted-login.mdx
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -36,7 +36,7 @@ Overall, ZITADEL's hosted login page simplifies the authentication process for d
36
36
### Flexible usernames
37
37
38
38
Different login name formats can be used on ZITADEL's hosted login page to select a user.
39
-
Login methods can be a user's username, containing the username and an [organization domain](/guides/manage/console/organizations-overview#usernames-and-domains), their email addresses, or their phone numbers.
39
+
Login methods can be a user's username, containing the username and an [Organization Domain](/guides/manage/console/organizations-overview#usernames-and-domains), their email addresses, or their phone numbers.
40
40
By default, all of these login methods are allowed and can be adjusted by [Administrators](/concepts/structure/administrators) to meet their requirements.
41
41
42
42
### Support for multiple authentication methods
@@ -77,7 +77,7 @@ Developers can customize elements such as logos, colors, and messaging to ensure
77
77
Customization and Branding
78
78
The login page can be changed by customizing different branding aspects and you can define a Custom Domain for the login (eg, login.acme.com).
79
79
80
-
By default, the displayed branding is defined [based on the user's domain](/guides/solution-scenarios/domain-discovery). In case you want to show the branding of a specific organization by default, you need to either pass a primary domain scope (`urn:zitadel:iam:org:domain:primary:{domainname}`) with the authorization request, or define the behavior on your Project's settings.
80
+
By default, the displayed branding is defined [based on the user's domain](/guides/solution-scenarios/domain-discovery). In case you want to show the branding of a specific organization by default, you need to either pass an Organization Domain scope (`urn:zitadel:iam:org:domain:primary:{domainname}`) with the authorization request, or define the behavior on your Project's settings.
Copy file name to clipboardExpand all lines: apps/docs/content/guides/integrate/services/google-workspace.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ At this time Google supports SSO with OpenID Connect only for few providers.
21
21
Prerequisites:
22
22
23
23
- You need to have a domain registered with your Google Workspace account to configure SSO profiles
24
-
- Make sure that you [verify the same domain also in your ZITADEL organization and set it as primary domain](/guides/manage/console/organizations-overview#primary-domain)
24
+
- Make sure that you [verify the same domain also in your ZITADEL organization and set it as Organization Domain](/guides/manage/console/organizations-overview#organization-domain)
25
25
- A user in Google Workspace (eg, road.runner@acme.com)
26
26
- A user in ZITADEL with the same username (eg, road.runner@acme.com); make sure you verify the domain to set the username. This is different than the user's email address
0 commit comments