zitadel / zitadel Goto Github PK

Relates to #30

• Create debug-image
• Abstract Short-SHA
• Test NPM Build
• Configure SEMREL to upload release artifacts
• Maybe Generate Pre-Release Uploads from feature branches

ZITADEL should provide a way to register web hooks for certain events.

For example if a developer wants to receive all user.create events he should be able to define a rule which invokes a endpoint.

We should Provide inbound Federation for OIDC

It would also be great to fix define a list of preconfigured providers which just need a Client-ID Client-Secret
IMHO these should be:

• Google
• AzureAD
• Github
• Gitlab
• OIDC Generic

Polices: TBD on which resource these can be applied

We need a way to delete Person identifiable information (PII)

use auth command side directly (must not use grpc)

• Register
• Check Username
• Check Password
• Check OTP
• Setup OTP
• Initial PW
• Init Verify
• Resend Init Code
• Email Verify
• Resend Email Code

Dependabot can't resolve your Go dependency files.

As a result, Dependabot couldn't update your dependencies.

The error Dependabot encountered was:

go: github.com/envoyproxy/[email protected]: reading github.com/envoyproxy/protoc-gen-validate/go.mod at revision v0.3.0: unknown revision v0.3.0

If you think the above is an error on Dependabot's side please don't hesitate to get in touch - we'll do whatever we can to fix it.

View the update logs.

Relates to #10

How to handle default policies, settings?

Dependabot can't resolve your Go dependency files.

As a result, Dependabot couldn't update your dependencies.

The error Dependabot encountered was:

go: github.com/envoyproxy/[email protected]: reading github.com/envoyproxy/protoc-gen-validate/go.mod at revision v0.3.0: unknown revision v0.3.0

If you think the above is an error on Dependabot's side please don't hesitate to get in touch - we'll do whatever we can to fix it.

View the update logs.

Use Case

As customer I want to verify my own domain.

• Root domain verification e.g caos.ch
• Sub domain verification e.g sub.caos.ch

Implementation

• #123

Polices

• Billing #122
• Username usage #117

Additional Impacts

• We need to have some kind of migration process available to users already created in the global org. see here -> #7

@adlerhurst already gathered lots of style guides, so please add missing topics

• Enums (names and defaults) (Proto: USER_STATE_ACTIVE, Go: UserStateActive)
• Proto in general (use validator, style guide: https://developers.google.com/protocol-buffers/docs/style)
• new vs struct (new just for declaration)
• linting in general
  • error ids (5Kürzel-5Zeichen 'REPO-Zhe73')
  • if / else / else if
• EventTypes: added/changed 'user.added, user.email.changed'

• User Agent
• User Session
• Auth Session (including Token)

• Support for CTAP2 i.e FIDO2

• Policies to enable / disable these settings

• Admin Console (GUI)
• Tests

• User
• Password
• Profile
• Email
• Phone
• Mfa
• User Grant

• Project
• Project Members
• Project Roles
• Applications
• Project Grants
• Project Grant Members

if i try to log in with a wrong username i get a connection error

Some way to easy start the IAM

• Auth Command Side
• Auth Query Side
• User Commands (Profile, Mail, MFA, ...)
• User Queries (Profile, Mail, MFA, ...)

Useful IAM Metrics

• Per Read Model Operation Log difference

• AuthN / Failed AuthN per time

• OIDC Tokens signed per time

• Active Sessions

• In General we should provide a metric per "handler" in form of req/sec

relates to #14 as the operator should consume IAM and DB Metrics -> FYI @stebenz @eliobischof @thesephirot

• Password Complexity Policy
• Password Age Policy
• Password Lockout Policy

• SMS
• Email

We need a function to transfer a global account to a hosted domain.
https://drive.google.com/drive/folders/1JuGYPw8J5AeO0dIRPwZfRgw9u9zOMn8k

• Org
• Org Members
• Setup Org

• Global User By Email
• Search Users
• Is Umique
• User Grants

• Polices to limit usage of certain resources
• Metrics to evaluate usage

What is it for

I think there will be customers who like to have the whole user basis at their discretion.
Especially customer accounts this would conflict with the global org..

How to solve

We could use a specific authorize and issuer url parameters to fix route traffic only into this org.
I think we could call this feature isolated org this would only have uniq keys for user within this org.

• Org Command Side
• Org Query Side (#59)
• Project Command Side
• Project Query Side
• User Command Side
• User Query Side

• customized email templates for domains
• render email template
• GUI

• Get Global Org by domain
• Search Orgs
• Search Org Members
• Get Org Member Roles
• generate domain on query side

restructured generator for domainnames and subdomains.

VARIABLES need to be aligned, there are still citadel and zitadel

e.g:

test/kustomization.yaml:    - CITADEL_AUTHORIZE=https://accounts-test.zitadel.dev/oauth/v2
test/kustomization.yaml:    - CITADEL_CONSOLE=https://console-test.zitadel.dev
test/kustomization.yaml:    - TRACING_PROJECT_ID=caos-citadel-test
test/imageversion.yaml:  name: citadel
test/imageversion.yaml:        - name: citadel
test/imageversion.yaml:          image: docker.pkg.github.com/caos/citadel/citadel:v0.40.13
test/namespace.yaml:  name: test-citadel
test/mappings/auth-grpc-v1.yaml:  host: api-test.zitadel.dev
test/mappings/auth-grpc-v1.yaml:  prefix: /caos.citadel.auth.api.v1.AuthService/
test/mappings/auth-grpc-v1.yaml:  service: api-auth-v1.test-citadel:8080
test/mappings/auth-grpc-v1.yaml:    origins: http://localhost:4200,https://console-test.zitadel.dev
test/mappings/mgmt-grpc-v1.yaml:  host: api-test.zitadel.dev

We should create a policy on the hosted_domain which defines if signup with a corresponding email is still possible -> see caos/citadel#1 , or if it is denied.

• Search Projects
• Search Project Roles
• Search Project Members
• Search Applications
• Search Project Grants
• Search Project Grant Members

We should somehow implement translation in backend

• Move Console to Zitadel Project
• Change some requests (Role)
• Change some entities (enums, ...)
• Reload lists if not current object (check sequence)

• Project Changes
• Application Changes
• User Changes
• Org Changes

• Iam
• Iam Members
• Set Up Initial Data

• Org Command Side
• Org Query Side

@stebenz @thesephirot @fforootd did discuss a possible DNS Structure and we came up with the following:

Development *.zitadel.app <- for internal testing, deploys the latest from master
-> in development we might use prefix and suffixes as well for feature branches
Preview *.zitadel.dev <- declares for external that it is in fact a test/dev system
Production *.zitadel.ch <- prod, what else

Any Inputs?