From bcce84860c4b73e97dc7033113a7dabbf8a549a2 Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Thu, 13 Aug 2026 14:24:40 +0530 Subject: [PATCH 1/4] version update info for OIDC --- .../platform-supported-content/modules/oidc.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index 8e836355bbf..777025040ef 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -392,13 +392,14 @@ See the section [Optional Features](#optional) information on additional optiona #### API Security Configuration for Client Credential Grant {#client-credential-grant} 1. Start your app, log in as an administrator, for example, *demo_administrator*, and access the Client Credential setup page. -2. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints. +2. If you are using version x.x.x of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails because audience validation is enabled by default. +3. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints. {{% alert color="info" %}}If the endpoint URL does not already end with `/.well-known/openid-configuration`, include it at the end. According to the specifications, the URL you need to enter typically ends with `/.well-known/openid-configuration`.{{% /alert %}} If you do not have an automatic configuration URL, you can fill in the other endpoints manually. -3. Optionally, you can select the **Custom AccessToken Parsing** microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information. -4. Click **Save**. Once you have completed these steps, the Client Credential Configuration is ready for testing. +4. Optionally, you can select the **Custom AccessToken Parsing** microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information. +5. Click **Save**. Once you have completed these steps, the Client Credential Configuration is ready for testing. #### Microsoft Entra ID Client Configuration for APIs {#azure} @@ -544,9 +545,9 @@ The following constants are mandatory when creating an OIDC SSO Client Credentia Example: `OIDC.Default_SAM_TokenProcessing_CustomATP` * **IsClientGrantOnly** (*default: false*) – allow to create Client Credential Configuration in the application -{{% alert color="warning" %}} -When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. -{{% /alert %}} + {{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. + {{% /alert %}} +* **OIDC.APIAuthentication** – If you want the api security client you can use the `APIAuthentication` microflow from the **OIDC.APIAuthentication** folder of the module. ## Configuring Multi-Domain {#multi-domain} From ba07624ff5d489e0061915b9f1627262e5878cb9 Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Mon, 17 Aug 2026 15:27:25 +0530 Subject: [PATCH 2/4] Add corrections --- .../platform-supported-content/modules/oidc.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index 777025040ef..121d3acb02b 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -547,7 +547,7 @@ Example: `OIDC.Default_SAM_TokenProcessing_CustomATP` {{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. {{% /alert %}} -* **OIDC.APIAuthentication** – If you want the api security client you can use the `APIAuthentication` microflow from the **OIDC.APIAuthentication** folder of the module. +* **EnableAudienceValidation** (boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience. ## Configuring Multi-Domain {#multi-domain} @@ -790,7 +790,7 @@ You can create your own APIs within your Mendix app and secure the end point ove 1. Create a REST API endpoint which needs to be secured. 2. Use **Custom** as the [authentication method](/refguide/published-rest-service/#authentication) to secure the endpoint with an access token. -3. Select the `OIDC.APIAuthentication` microflow which has `HTTPRequest` as the input and returns `System.User` as the output. +3. Select the `OIDC.APIAuthentication` microflow from the **OIDC.APIAuthentication** folder of the module which has `HTTPRequest` as the input and returns `System.User` as the output. ### Using `APIAuthentication` for Client Credentials Grant @@ -799,7 +799,9 @@ The client credentials grant type is used when applications request an access to 1. Request an Access Token using `/token` endpoint. 2. Access the Secured API Endpoint 3. `APIAuthentication` will validate the token and extract the claims. -4. The OIDC SSO module checks if the `sub` claim (which contains the `client-id`) is present in the access token. If it is not, the module will verify the `client_id`, `appid`, or `cid` parameters. If none of these are found, it will throw an exception message. +4. The OIDC SSO module checks + * if the `sub` claim (which contains the `client-id`) is present in the access token. If it is not, the module will verify the `client_id`, `appid`, or `cid` parameters. If none of these are found, it will throw an exception message. + * if the `audiencevalidationenabled` is true then verify the resource path and expected audince based on the configured values. 5. Create a new user using the client ID from the token if one does not already exist. {{% alert color="info" %}} From 81b093d45660a1fb0c45cab88dcd5c2ee47d0126 Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Mon, 17 Aug 2026 16:09:45 +0530 Subject: [PATCH 3/4] Add upgrading info --- .../marketplace/platform-supported-content/modules/oidc.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index 121d3acb02b..2eaf939b63f 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -203,6 +203,7 @@ This section provides an overview of updates for the OIDC SSO module across diff | Mendix Version | OIDC SSO Module Version | Important Migration Changes | Additional Information | | --- | --- | --- | --- | +| 10.24.0 and above | 4.x.x | - | New constant (`EnableAudienceValidation`) has been introduced for the api security. Configure the required values as they are mandatory for the api security flow. | | 10.24.0 and above | 4.6.0 | - | New constant (`OIDC.NonceCookieSameSite`) has been introduced. | | 10.24.0 and above | 4.5.0 | - | New Admin UI and new constants have been introduced. | | | | | `Anonymous` module role has been removed. | @@ -392,7 +393,7 @@ See the section [Optional Features](#optional) information on additional optiona #### API Security Configuration for Client Credential Grant {#client-credential-grant} 1. Start your app, log in as an administrator, for example, *demo_administrator*, and access the Client Credential setup page. -2. If you are using version x.x.x of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails because audience validation is enabled by default. +2. If you are using version x.x.x of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails as audience validation is enabled by default. 3. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints. {{% alert color="info" %}}If the endpoint URL does not already end with `/.well-known/openid-configuration`, include it at the end. According to the specifications, the URL you need to enter typically ends with `/.well-known/openid-configuration`.{{% /alert %}} @@ -547,7 +548,7 @@ Example: `OIDC.Default_SAM_TokenProcessing_CustomATP` {{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. {{% /alert %}} -* **EnableAudienceValidation** (boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience. +* **EnableAudienceValidation** (Boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience. ## Configuring Multi-Domain {#multi-domain} From fa88fb170d184ae61abe2106df7dae9b0f0a21ad Mon Sep 17 00:00:00 2001 From: Karuna Vengurlekar Date: Mon, 24 Aug 2026 15:16:07 +0530 Subject: [PATCH 4/4] Implement feedback --- .../modules/oidc.md | 22 ++++++++++++++----- 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index 2eaf939b63f..808300ee02d 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -203,7 +203,7 @@ This section provides an overview of updates for the OIDC SSO module across diff | Mendix Version | OIDC SSO Module Version | Important Migration Changes | Additional Information | | --- | --- | --- | --- | -| 10.24.0 and above | 4.x.x | - | New constant (`EnableAudienceValidation`) has been introduced for the api security. Configure the required values as they are mandatory for the api security flow. | +| 10.24.0 and above | 4.7.0 | - | A new constant (`EnableAudienceValidation`) has been introduced for API security. Because it is enabled by default, you need to configure the **Resource path** and **Expected audience** value. You can disable audience validation, but Mendix does not recommend this. | | 10.24.0 and above | 4.6.0 | - | New constant (`OIDC.NonceCookieSameSite`) has been introduced. | | 10.24.0 and above | 4.5.0 | - | New Admin UI and new constants have been introduced. | | | | | `Anonymous` module role has been removed. | @@ -393,14 +393,24 @@ See the section [Optional Features](#optional) information on additional optiona #### API Security Configuration for Client Credential Grant {#client-credential-grant} 1. Start your app, log in as an administrator, for example, *demo_administrator*, and access the Client Credential setup page. -2. If you are using version x.x.x of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails as audience validation is enabled by default. -3. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints. +2. If you are using version 4.7.0 of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails because audience validation is enabled by default. + + {{% alert color="info" %}} +The correct audience value for your API depends on the IdP you are using. For Entra ID, the **Expected audience** value also depends on how you registered your API in Entra ID. When using version 2 tokens, your application's client ID is the expected audience value. + +For example, in the **Manifest** of your Entra ID app: + +* If `requestedAccessTokenVersion` is `2`, the audience value is the client ID of the application. +* If `requestedAccessTokenVersion` is `null`, the audience value is `api://` of the application. + {{% /alert %}} + +1. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints. {{% alert color="info" %}}If the endpoint URL does not already end with `/.well-known/openid-configuration`, include it at the end. According to the specifications, the URL you need to enter typically ends with `/.well-known/openid-configuration`.{{% /alert %}} If you do not have an automatic configuration URL, you can fill in the other endpoints manually. -4. Optionally, you can select the **Custom AccessToken Parsing** microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information. -5. Click **Save**. Once you have completed these steps, the Client Credential Configuration is ready for testing. +1. Optionally, you can select the **Custom AccessToken Parsing** microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information. +1. Click **Save**. Once you have completed these steps, the Client Credential Configuration is ready for testing. #### Microsoft Entra ID Client Configuration for APIs {#azure} @@ -548,7 +558,7 @@ Example: `OIDC.Default_SAM_TokenProcessing_CustomATP` {{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. {{% /alert %}} -* **EnableAudienceValidation** (Boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience. +* **EnableAudienceValidation** (Boolean) – If you are setting this as a true then make sure to set **Resource path** and **Expected audience** in the **Client Credential grant for API security** tab. When you create a [Published REST service](/refguide/published-rest-operation/) in your mendix app, you can find the resource path at the **Operations for resource 'data'** section. For more information, see the [API Security Configuration for Client Credential Grant](#client-credential-grant) section above. ## Configuring Multi-Domain {#multi-domain}