Version update info for OIDC - #11729
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| {{% /alert %}} | ||
| {{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. | ||
| {{% /alert %}} | ||
| * **EnableAudienceValidation** (boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience. |
There was a problem hiding this comment.
🚫 [vale] reported by reviewdog 🐶
[Mendix.Capitalization] Use ''Boolean'' (capitalized)
|
|
||
| 1. Start your app, log in as an administrator, for example, *demo_administrator*, and access the Client Credential setup page. | ||
| 2. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints. | ||
| 2. If you are using version x.x.x of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails as audience validation is enabled by default. |
There was a problem hiding this comment.
I would want to have some guidance for citizen developers, who are not IAM experts.
Maybe we can add:
"What the proper audience value is for your API, depends on the IdP you are using. For customers using Entra ID, the expected audience value also depends on how you've registered your API at Entra ID. When using version 2 tokens, your application's client ID is the expected audience value."
This needs to be checked with the team for correctness.
|
|
||
| | Mendix Version | OIDC SSO Module Version | Important Migration Changes | Additional Information | | ||
| | --- | --- | --- | --- | | ||
| | 10.24.0 and above | 4.x.x | - | New constant (`EnableAudienceValidation`) has been introduced for the api security. Configure the required values as they are mandatory for the api security flow. | |
There was a problem hiding this comment.
I think we could something like :
"Given the fact that it is enabled by default, the customers need to configure resource path and expected audience value.
As an alternative, customers can chose to disable audience validation (not recommended)."
| {{% /alert %}} | ||
| {{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. | ||
| {{% /alert %}} | ||
| * **EnableAudienceValidation** (Boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience. |
There was a problem hiding this comment.
What is 'resource path' in this context? Let's explain. Also because it's not a concept from OAuth/OIDC, so i expect customers to be confused as well.
2 participants
No description provided.