ZITADEL

Z

ZITADEL

ZITADEL - Identity infrastructure, simplified for you.

Join

questions-help-bugs

product-feedback-requests

Migrating from CRDB to PGSQL

Has anyone migrated from cockroach DB to Postgres for Zitadel running via docker? I’ve been trying but have been unsuccessful. Any guidance would be much appreciated!

Organization Home Page Customization

Hello, is there anyway to custom this page?
No description

Disabling MFA globally

Is there any way to disable the MFA prompt which appears after the first login for the users (/ui/login/password)? I added those texts, but it seems that users don't read, just tap without knowing what MFA is, and later they don't know how to validate/use it 🙂 I have already configured Multifactor Init Check with a value of 0 as per https://zitadel.com/docs/guides/solution-scenarios/configurations#disable-multi-factor-mfa-prompt but the prompt still appears....
No description

Roles missing in access token (JWT)

Hello. I'm trying to request access tokens with projects' roles without success - is this a bug or am I missing something? Authorization request (line breaks for readability): ``` note the scopes:...

Debugging token handshake

hello - I need some really basic advice :/ After an upgrade from 2.67 to 2.71 last week we have the strange situation that a python script to get an access token via an assertion is no longer working on the prod env (windows server) but still works on Linux. We are unable to spot any error on the client side and even on "debug" level I just get the final generic error message. The "trace" log level seems to be unknown to zitadel so my question is simply: Is there any chance to "watch" whats happening inside Zitadel during the failed handshake to track down the problem?...

Initate Login URI from SSO provider

Hello, I have a client who is integrating with us using their okta oidc client. For the most part everything is working well, but we want to enable the ability for their okta client to initiate the login process rather than relying on the login button from our login page to their specific okta client. Okta supports this easily enough, but it has a Initate Login URI configuration variable that I don't know what to tell them to put in. For reference, when specified and the client then tries to start the login, they are redirected to the configured URI with an iss search param that refers back to the cleints SSO provider. I assume at that point the app just needs to redirect to that issuer the same way the redirection happens if the user were to click the SSO button on our login page. I've attached a picture of the configration options within Okta....
No description

Limiting access based on roles

I’m curious if I there is a dropdown or something in the UI I can use to limit access to an application or project based on user roles? Recently saw this implemented in pocket-id and would like a similar implementation....
No description

Assigning Roles through Create Human User Endpoint

Is it possible to assign roles during new user creation? I am using the endpoint https://$CUSTOM-DOMAIN/v2/users/human...

Setup custom SMS/HTTP provider per Terraform

It is possible to configure SMS/EMAIL provider via admin API. https://zitadel.com/docs/guides/manage/customize/notification-providers But how to configure it per Terraform? I would like to avoid having some configuration in terraform and some configuration in proprietary scripts for configuring....

Lockout policy

Is there any way to unblock the blocked account after some time (e.g. 15 minutes)? The maximum password attempts feature is nice, but this would mean we need somebody who unlocking the blocked people. Automatically expired blockings would be a pragmatic solution for it....

Metada in API response

Hello, I was surprised not to have the user's metadata in the API call return. I saw this two issues that talk about the same https://github.com/zitadel/zitadel/issues/9033 https://github.com/zitadel/zitadel/issues/9053 ...

Customer portal, create new instance, no way to cancel it

Cancel Button and Window close button don't close the create instance dialog. Only way to get the rid of the dialog is F5 refresh. (if you don't want to create instance). Browser : Firefox 136.0.3 System: Ubuntu...

Zitadel - Facing issue while changing the logo

Hi, I am trying to change the zitadel logo in branding settings, but i have faced the error like "Http failure response for https://demoauth.inhlth.app/assets/v1/org/policy/label/logo/dark: 401 OK" Can anyone advice me why this error is happening

Zitadel IDs

How does Zitadel generate IDs? Is there a specific formula or something? In our Infrastructure we use 2 Zitadel Instances one for dev and the other for production. Goal is to mirror the production db into dev db server where zitadel dev is hosted In the app, zitadel ids are saved to keep track of the users, question is: are ids the same, generated the same because same Microsoft account was used?...

How to programmatically activate a user through the API

I am struggling with a problem currently, which is the following: I have the option to create a user with emailVerified and password to set him as Activated. But If I don't create a user already as activated...I find no way to programmatically Activate a user and set his/her password from the API....

Pre-verify arbitrary strings sent as PATs

Hi there. We currently use JWKs based JWT validation in each of our microservices which works perfectly fine. Now, to ease development and maybe provide "API key" style access later (as soon as PATs may be available for normal users), we also think about adding PATs support to our validation process. The big main concern right now is that PATs seem to defenitely require a call to the introspection endpoint without the possibilty to pre-verify that they are indeed Zitadel PATs that can be introsp...

Zitadel login as admin returns An internal error occurred

I am trying to log in to my Zitadel instance with the correct email and password but I'm getting An internal error occurred and there are no logs.

Add trusted domains via UI or Terraform

Hi everyone, anyway to add a trusted domain via UI or Terraform instead of calling the API?

Custom OIDC Endpoints Not Working

Custom oidc endpoints were configured using environment variables, zitadel changed the URLs of those endpoints, we can see that in the first print, however when acess zitadel i receive a not found error on those endpoints
No description

Upgrade from 2.70.x to 2.71.x fails with migration errors

When upgrading from 2.70.7 to 2.71.5 running in docker from the official GHCR image, I get this error, and the container fails:
time="2025-03-28T17:41:50Z" level=info msg="starting migration" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:66" name=52_idp_templates6_ldap2
time="2025-03-28T17:41:50Z" level=error msg="migration failed" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:68" error="ERROR: relation \"idp_templates6_ldap2\" already exists (SQLSTATE 42P07)" name=52_idp_templates6_ldap2
time="2025-03-28T17:41:50Z" level=fatal msg="migration failed" caller="/home/runner/work/zitadel/zitadel/cmd/setup/setup.go:304" code=42P07 detail= error="ERROR: relation \"idp_templates6_ldap2\" already exists (SQLSTATE 42P07)" hint= message="relation \"idp_templates6_ldap2\" already exists" name=52_idp_templates6_ldap2 severity=ERROR
time="2025-03-28T17:41:50Z" level=info msg="starting migration" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:66" name=52_idp_templates6_ldap2
time="2025-03-28T17:41:50Z" level=error msg="migration failed" caller="/home/runner/work/zitadel/zitadel/internal/migration/migration.go:68" error="ERROR: relation \"idp_templates6_ldap2\" already exists (SQLSTATE 42P07)" name=52_idp_templates6_ldap2
time="2025-03-28T17:41:50Z" level=fatal msg="migration failed" caller="/home/runner/work/zitadel/zitadel/cmd/setup/setup.go:304" code=42P07 detail= error="ERROR: relation \"idp_templates6_ldap2\" already exists (SQLSTATE 42P07)" hint= message="relation \"idp_templates6_ldap2\" already exists" name=52_idp_templates6_ldap2 severity=ERROR
...