diff --git a/.sources/VERSIONS b/.sources/VERSIONS index dacb31f..099eca5 100644 --- a/.sources/VERSIONS +++ b/.sources/VERSIONS @@ -62,4 +62,4 @@ motoko-core v2.4.0 cdk-rs ic-cdk v0.20.1 / ic-cdk-timers v1.0.0 / ic-cdk-executor v2.0.0 317f55c candid 2025-12-18 # candid v0.10.20, didc v0.5.4 2e4a2cf response-verification v3.1.0 18c5a37 -internetidentity release-2026-07-17 8ffbe6f6 +internetidentity release-2026-07-27 f94dde5f diff --git a/.sources/internetidentity b/.sources/internetidentity index 8ffbe6f..f94dde5 160000 --- a/.sources/internetidentity +++ b/.sources/internetidentity @@ -1 +1 @@ -Subproject commit 8ffbe6f6424ace469f3a2ae1dd277561cd4e7bbe +Subproject commit f94dde5fb28489b7afb3653951f4fadd1ce5af1e diff --git a/public/references/internet-identity.did b/public/references/internet-identity.did index 9554ab2..3208529 100644 --- a/public/references/internet-identity.did +++ b/public/references/internet-identity.did @@ -306,17 +306,12 @@ type InternetIdentityInit = record { new_flow_origins : opt vec text; // Configurations for OpenID clients openid_configs : opt vec OpenIdConfig; - // Allowlist of domains that may be used as discoverable SSO providers. - // When set, fully replaces the built-in defaults. When unset, falls back - // to `dfinity.org` (production) or `beta.dfinity.org` (everything else), - // keyed off `is_production`. - sso_discoverable_domains : opt vec text; - // Deploy flag opening the SSO discovery domain gate to any domain. When - // `true`, `sso_discoverable_domains` (and its defaults) no longer restrict - // which domains may be discovered as SSO providers. Does not relax the - // strict-`https` requirement: serving discovery over plain `http` still - // requires the host to be on the explicit `sso_discoverable_domains` list. - sso_allow_any_domain : opt bool; + // Deploy flag relaxing the `https` requirement for SSO discovery outcalls to + // loopback hosts (`localhost` / `127.0.0.1`) so e2e tests can point at local + // mock IdPs served over plain `http`. Unset / `false` (the default) require + // `https` for every discovery host. Never enable in production — non-loopback + // hosts always require `https` regardless. + sso_allow_insecure_discovery : opt bool; // One-shot backfill of the `sso_domain` / `sso_name` fields on stored // OpenID credentials. When set, a batched timer-driven migration stamps // every stored credential whose (iss, aud) matches an entry and whose @@ -488,20 +483,28 @@ type OpenIdConfig = record { // from the domain's two-hop discovery documents, on demand and cached. type SsoDiscovery = record { discovery_domain : text; + // The org's primary OIDC client. client_id : text; issuer : text; authorization_endpoint : text; scopes : vec text; name : opt text; + // Client the target origin runs its ceremony against; `null` when denied. + resolved_client_id : opt text; }; -// State of a domain's SSO discovery, read by `get_sso_discovery`. A failed -// fetch isn't a distinct state — it reads as `Pending` and the frontend times -// out — so the states are resolved, in flight, or not allowed. -type SsoDiscoveryState = variant { +// Status of a domain's SSO discovery, read by `get_sso_discovery_status`. A +// failed fetch isn't a distinct status — it reads as `Pending` and the frontend +// times out — so the statuses are: resolved, or in flight. +type SsoDiscoveryStatus = variant { Resolved : SsoDiscovery; Pending; - NotAllowed; +}; + +// Request for `get_sso_discovery_status`. +type GetSsoDiscoveryStatusRequest = record { + org_domain : text; + target_app_origin : opt FrontendHostname; }; type OpenIdCredentialKey = record { Iss; Sub; Aud }; @@ -558,6 +561,40 @@ type OpenIdPrepareDelegationResponse = record { anchor_number : UserNumber; }; +// Request for `sso_prepare_delegation`. +type SsoPrepareDelegationRequest = record { + jwt : JWT; + salt : Salt; + session_key : SessionKey; + org_domain : text; + target_app_origin : FrontendHostname; +}; + +// Request for `sso_get_delegation`. +type SsoGetDelegationRequest = record { + jwt : JWT; + salt : Salt; + session_key : SessionKey; + expiration : Timestamp; + org_domain : text; + target_app_origin : FrontendHostname; + sso_attr_bundle : blob; +}; + +// Response of `sso_prepare_delegation`. +type SsoPrepareDelegationResponse = record { + user_key : UserKey; + expiration : Timestamp; + anchor_number : UserNumber; + sso_attr_bundle : blob; +}; + +// Response of `sso_get_delegation`. +type SsoGetDelegationResponse = record { + signed_delegation : SignedDelegation; + sso_attr_bundle_signature : blob; +}; + // Email-recovery types // ==================== // See `docs/ongoing/email-recovery.md` for the full design. Covers @@ -902,6 +939,8 @@ type OpenIDRegFinishArg = record { // SSO discovery domain the JWT was obtained through, or null for a direct // provider (Google / Microsoft / Apple). Selects the JWK source. discovery_domain : opt text; + // Target dapp origin, set only for a first gated SSO login. + origin : opt text; }; // Extra information about registration status for new authentication methods @@ -1267,6 +1306,9 @@ type IdRegFinishError = variant { InvalidAuthnMethod : text; // Error while persisting the new identity. StorageError : text; + // A gated SSO login for a non-`sub` org: the user must first sign in + // through the org's primary client. + SsoNormalLoginRequired; }; type AccountInfo = record { @@ -1667,11 +1709,20 @@ service : (opt InternetIdentityInit) -> { openid_get_delegation : (JWT, Salt, SessionKey, Timestamp, opt text) -> (variant { Ok : SignedDelegation; Pending; Err : OpenIdDelegationError }) query; // SSO discovery for the sign-in initiation flow. The frontend polls - // `get_sso_discovery` (query) and, while it reads `Pending`, drives the + // `get_sso_discovery_status` (query) and, while it reads `Pending`, drives the // on-demand two-hop discovery fetch with `discover_sso` (update); once the // fetch completes the query returns `Resolved` with the config. + // + // The optional second argument is the target dapp origin; when supplied, + // `resolved_client_id` reports the client that origin must use (`null` = denied). discover_sso : (text) -> (); - get_sso_discovery : (text) -> (SsoDiscoveryState) query; + get_sso_discovery_status : (GetSsoDiscoveryStatusRequest) -> (SsoDiscoveryStatus) query; + + // SSO sign-in path. Mints a delegation only if the JWT's `aud` matches the + // client the target origin resolves to. `Pending` means the discovery/JWKS + // cache is cold — re-call to drive the fetch. + sso_prepare_delegation : (SsoPrepareDelegationRequest) -> (variant { Ok : SsoPrepareDelegationResponse; Pending; Err : OpenIdDelegationError }); + sso_get_delegation : (SsoGetDelegationRequest) -> (variant { Ok : SsoGetDelegationResponse; Pending; Err : OpenIdDelegationError }) query; // =================================================================== // Email-challenge protocol (shared inbound-DKIM primitive)