Jean-Gabriel Gill-Couture 0090c9e23f fix(zitadel-jwt): exchange the id_token for OpenBao, not the opaque access_token ...

ZitadelJwtBearer posted Zitadel's access_token to OpenBao's jwt/login. Zitadel
issues opaque access tokens by default, so OpenBao rejected it with "compact JWS
format must have three parts". The token endpoint already returns an id_token (a
JWT) because build_scope requests `openid`; use it. It carries the service user
in `sub` and the project id in `aud` (the latter via the project🆔aud scope) —
exactly what the OpenBao JWT role binds on. No Zitadel-side change needed (the
manual id_token exchange already proved this works).

2026-06-25 11:37:08 -04:00

..

src

fix(zitadel-jwt): exchange the id_token for OpenBao, not the opaque access_token

2026-06-25 11:37:08 -04:00

Cargo.toml

fix: break harmony_secret↔harmony_zitadel_auth dependency cycle

2026-06-11 13:50:48 -04:00