We're currently implementing user groups which have been requested by 100+ users from our community
Weβre currently working on including group info in ID/Access token claims, and weβd love your input on how this should look to make it easy for you. Below are three possible formats - please cast your votes :gigilove:
As an administrator I want to be able to manage groups, add users and be able to give the whole group authorizations for a project in the ZITADEL console, so I do not have to manage it for all user...
Hey there I'm Elina, product manager here at Zitadel :zitadel: I'd love to understand how was your first time experience of using Zitadel in cloud - was it easy to integrate Zitadel and get your first user created/ logged in or did you struggle somewhere along the way?
I'll post a couple of polls and would also appreciate any additional context you can provide about specific areas we should improve. Thank you in advance for your feedback , we'll take it on board and see what we can do:gigilove:
We're beginning to build out a robust Threat Detection framework within Zitadel, leveraging the data we have available. To ensure we create a truly valuable and effective solution, we're seeking your insights into your specific needs and expectations in this critical area.
We're particularly interested in understanding:
Different use cases you envision for threat detection within your identity and access management system.
How you would ideally like to identify potential threat vectors. What indicators or data points are most relevant to your security concerns?
What actions should be triggered within Zitadel when suspicious activity is detected? (e.g., alerts, temporary account lockout, requiring multi-factor authentication, etc.)
Can you share any past security problems or incidents you've experienced that you wish you could have identified and analyzed earlier? Understanding these scenarios will be invaluable in shaping our proactive detection capabilities.
Are there any specific analysis or reporting features you would find beneficial for investigating potential threats?
If you have experiences or insights related to Threat Detection that you'd be willing to share, please share your insights below.
When booking, please specify that you'd like to discuss Thread Detection. Your input will directly contribute to the development of a powerful and tailored security framework within Zitadel.
We're continuing our exploration into Hierarchies and Groups within identity and access management, and we're particularly interested in understanding why this functionality is becoming increasingly crucial for your organizations. We've observed various potential use cases, and we want to delve deeper into the core motivations and benefits you seek.
Specifically, we'd like to understand why hierarchies and groups are essential for you. For example, is it to:
Streamline permission and role management at a group level?
Configure branding or authentication options based on organizational units or teams?
Provide essential group information to your business applications for operational purposes?
Address other critical needs we haven't yet considered?
What are the different ways you envision using hierarchies or groups within your organization? (e.g., organizational structure, project teams, access levels, geographical regions, etc.)
What problems are you currently trying to solve or what benefits are you hoping to achieve by implementing hierarchical structures or advanced group management?
I am eager to learn about the specific problems you are trying to solve or the significant advantages you anticipate gaining through the effective use of hierarchies and groups. Understanding these crucial drivers will help us ensure Zitadel provides the most impactful solutions. If you can share your insights on why Hierarchies and Groups are critical for your IAM strategy, please share your insights below. When booking, please specify that you'd like to discuss Hierarchies/Groups. Looking forward to get your insights!
We're currently focusing on the growing need for fine-grained authorization among our customers. We've observed an increasing demand for more granular control over access to avoid potential security risks associated with providing users with overly broad permissions.
To better understand your specific use cases and needs in this area, and to explore how Zitadel can best address them, we'd love to hear from you. We are particularly interested in learning about:
Specific scenarios where fine-grained authorization is critical for your organization.
The challenges you currently face with managing access control.
Your ideal requirements and expectations for a fine-grained authorization solution.
Any existing tools or methods you are currently using or evaluating.
Any regulations or compliance requirements that influence your authorization needs.
If you're interested in discussing your experiences and providing valuable feedback on fine-grained authorization, please share your insights below in this thread. Your input is greatly appreciated and will be instrumental in shaping how Zitadel can empower you with more precise and secure access control. Thank you!
The release candidate for Zitadel V3 is now available, and we would greatly appreciate your feedback prior to the generally available release later on this month.
Key features & improvements coming with V3:
Actions V2
Discontinuation of Cockroach DB support
For a more comprehensive outline of all changes in V3, check out our dedicated epic!
Limitations/bugs: No known bugs or limitations with V3 yet
Please test the latest version of Zitadel and share your feedback below. If you have any suggestions or have any bug reports to share, please create an issue on GitHub!
We want to hear which authorization tools you're using with ZITADEL!
Please take a second to vote in our poll below and let us know which authz tools you're using with ZITADEL or currently evaluating to use with ZITADEL. If you don't see your tool listed, leave a comment on this thread to let us know which tool you're using & how your experience with integrating them with ZITADEL has been so far.
As we continue improving your ZITADEL experience, we'd love to learn more about which tools and platforms you're switching from to ensure we make your migrations smoother through more detailed documentation& other resources.
Please take a second to vote in our poll below and let us know which sources you're migrating from. If you don't see your source listed, leave a comment on this thread to let us know where you're coming from AND what your migration experience to ZITADEL has been like so far.
In our continued efforts to improve your Zitadel experience & accelerate your time to integration, we're actively looking for feedback on SDKs! We'd love insight into which SDKs we should focus on first.
Please take a second to vote in our poll below and let us know which SDKs are most important to you!
If you notice that your preferred SDK isn't listed, leave a comment on this thread and let us know how that SDK would help you based on your use case.
Don't forget to upvote the comments of other community members if you have an interest in their suggested SDKs!
Thanks for your feedback!
(Quick note: The polls are split into three, you can select multiple options from all polls - Thanks again!)
SCIM (System for Cross-domain Identity Management) is a standard that allows the exchange of user identity information between different systems, such as when a new employee is onboarded and needs to be provisioned to various applications. For more detailed information read the section about the User Resource Schema in the RFC7643.
As a long requested feature, the first version of our SCIM 2.0 Server implementation is now ready to test. The implementation is compliant with the standard and includes all requests for the user resource and the discovery endpoints.
Testing Period: till 31. March 2025 Testing Objectives:
Did you encounter problems or bugs?
Which SCIM 2.0 clients did you test? Did you have any problems with it?
Have you identified any areas of non-compliance with the standard?
Any input or feedback on how we implemented the feature? How to test: You can either send your API requests with curl or a rest Client, or use your existing system which has implemented a SCIM 2.0 client, to manage the users. Some example curl requests can be found in our API docs. Zitadel Version:>=v2.69.0
Known Bugs / Limitations: You can find all limitations listed in our SCIM 2.0 Guide.
Note: Be aware that this feature is currently in a preview state and will be put behind a commercial license once it is fully available.
Test the SCIM 2.0 server and add improvement or bug reports to the github repository or let us know your general feedback below!
The System for Cross-domain Identity Management (SCIM) specifications are designed to make identity management in cloud-based applications and services easier. The specification suite builds upon experience with existing schemas and deployments, placing specific emphasis on simplicity of development and integration, while applying existing authe...
We're looking for your feedback on our API design and documentation.
Currently, most of our APIs are available as REST and gRPC APIs, but the documentation is only provided as OpenAPI documentation. This can lead to confusion for our customers because not everything can be documented correctly, and we have some missing or wrong documentation because of some limitations on how REST is generated from the gRPC APIs.
We're considering switching fully to gRPC with connect RPC from API version 2 and removing the OpenAPI implementation. For the API/Client we would use buf registry(we already rely on buf to generate the stubs). Some APIs like OIDC, SAML and SCIM are excluded from this. ConnectRpc allows you to still query the apis with a simple curl command and we can easily show examples in our guides. This would allow us to provide more accurate and complete documentation.
Having reached a good level of maturity since joining CNCF in June 2024, connect RPC is now a robust solution, making this the ideal time to adopt it.
Connect RPC curl example:
We'd like to know your thoughts on this. Please take a moment to answer the poll below, and describe the reason for your answer in the chat below.
The Token Exchange grant implements RFC 8693, OAuth 2.0 Token Exchange and can be used to exchange tokens to a different scope, audience or subject. Changing the subject of an authenticated token is called impersonation or delegation.
A typical use case is when customer support uses the token exchange to temporarily access a userβs account, allowing them to troubleshoot issues without needing the userβs password.
Or follow the impersonation example: https://zitadel.com/docs/guides/integrate/token-exchange#impersonation-examples Known Bugs / Limitations: At the moment token exchange is only implemented for your own applications, but not for getting access to a Zitadel Manager account. Token exchange works for Zitadel created Tokens currently, in the future the possibility for external services will be added as well. Track the state in the corresponding issue.
Test the token exchange and add improvement or bug reports directly to the github repository or let us know your general feedback below!
This specification defines a protocol for an HTTP- and JSON-based Security Token Service (STS) by defining how to request and obtain security tokens from OAuth 2.0 authorization servers, including security tokens employing impersonation and delegation.
The Token Exchange grant implements RFC 8693, OAuth 2.0 Token Exchange and can be used to exchange tokens to a different scope, audience or subject. Changing the subject of an authenticated token is called impersonation or delegation. This guide will explain how token exchange is implemented inside ZITADEL and gives some usage examples.
The client package is a TypeScript and JavaScript client library for interacting with all available Zitadel APIs. It allows developers to easily integrate their applications for authentication, authorization, and user management in Node.js and browser environments.
The proto package provides Zitadelβs type definitions to use with the client package and interact with Zitadelβs gRPC APIs in any TypeScript or JavaScript application.
Testing Period: till 31. March 2025 Testing Objectives:
Did you encounter problems or bugs?
General feedback on feature enhancements
Do you miss any features in the package? How to test: You can find the installation and usage instructions in the following links:
This package exports services and utilities to interact with ZITADEL. Latest version: 1.0.2, last published: 16 days ago. Start using @zitadel/client in your project by running . There are no other projects in the npm registry using @zitadel/client.
This package provides the Protocol Buffers (proto) definitions used by ZITADEL projects. It includes the proto files and generated code for interacting with ZITADEL's gRPC APIs.. Latest version: 1.0.2, last published: 16 days ago. Start using @zitadel/proto in your project by running . There is 1 other project in the npm re...
Web Keys are used to verify and sign JWT tokens in the OIDC standard. Listening to the feedback of the community we have changed the handling of web keys. Previously they were automatically generated by Zitadel once the first token had been created and rotated automatically afterwards. This caused problems for some providers as the key's endpoint did not return any key till that point. With the new implementation you can manage the keys yourself, which also gives you the ability to rotate them at your convenience.
Improving the performance of Zitadel has been a big topic over the last couple of months. Among other things we have implemented caches, which speed up the lookup of frequently used objects. The implementation is currently done for Instances, Organizations and Milestones and will be further expanded in the future.
Testing Period: till 28. February 2025 Testing Objectives:
Did you have any problems with the configuration?
Did you encounter problems or bugs?
Does it help with the performance of your system?
Where should we add more caches?
Do you want to see some other connectors? How to test: You can find the configurations and how to test the caches in our documentation: https://zitadel.com/docs/self-hosting/manage/cache Known Bugs / Limitations:
Only implemented for Instances, Organizations and Milestones at the moment.
ZITADEL supports the use of a caches to speed up the lookup of frequently needed objects. As opposed to HTTP caches which might reside between ZITADEL and end-user applications, the cache build into ZITADEL uses active invalidation when an object gets updated. Another difference is that HTTP caches only cache the result of a complete request and...
Preflight Checklist I could not find a solution in the documentation, the existing issues or discussions I have joined the ZITADEL chat Environment Self-hosted Version 2.67.1 Database PostgreSQL Da...
Preflight Checklist I could not find a solution in the documentation, the existing issues or discussions I have joined the ZITADEL chat Version 2.55.x (but also in latest) Describe the problem caus...
We've developed a new TypeScript-based login system to streamline the authentication process. This solution offers a flexible, customizable, and self-hostable login experience. By providing a ready-to-use login solution, we aim to reduce development time and effort.
Our immediate goal is to enable customers to self-host the login system. In the future, we plan to fully integrate this new login system into our cloud offering.
The new TypeScript login system offers several key improvements:
Leverages Modern Technology: By utilizing our newly developed session APIs, we've significantly enhanced the security and performance of the authentication process.
Enhanced Features: The system introduces new features such as user invitation flows and passkey-only authentication, providing greater flexibility and convenience for our users.
Improved Developer Experience: The use of TypeScript, a widely adopted language in frontend development, makes the codebase more accessible and easier to contribute to. This encourages community involvement and fosters rapid development.
If you have any suggestions for improvement or bug reports please open an issue in the typescript repository, any other feedback we'd love to hear in this thread.