sdgoij/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-01-16 20:50:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added more details about Zitadel SSO_AUDIENCE_TRUSTED

Harshavardhan Musanalli
2025-08-10 15:54:01 +02:00
parent ed44dafd61
commit 67d92bedd0
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Enabling-SSO-support-using-OpenId-Connect.md

@@ -236,7 +236,9 @@ To obtain a `refresh_token` to be able to extend session you'll need to add the
Additionally Zitadel include the `Project id` and the `Client Id` in the audience of the Id Token.
For the validation to work you will need to add the `Resource Id` as a trusted audience (`Client Id` is trusted by default).
You can control the trusted audience with the config `SSO_AUDIENCE_TRUSTED`
You can control the trusted audience with the config `SSO_AUDIENCE_TRUSTED`.
According to [Zitadel#9200](https://github.com/zitadel/zitadel/issues/9200), `id_token` passes a list of trusted audiences including the `Project Id`. If you end up having many trusted `aud` strings, `SSO_AUDIENCE_TRUSTED`, may become unmanageable. In such cases, `SSO_AUDIENCE_TRUSTED: '^\d{18}$'` (18 is the size of each string in `aud` list, it may differ depending on your Zitadel implementation) would help you but it's safe to individually add all the `aud` strings like `SSO_AUDIENCE_TRUSTED: '^abcd|def|xyz$'`.
Since [zitadel#721](https://github.com/zitadel/oidc/pull/721) PKCE should work with client secret.
But older versions might have to disable it (`SSO_PKCE=false`).