Issue: User are forced to login with External Provider (IdP) while both are allowed

Original message was deleted

Raccine•1/6/25, 1:27 PM

Hey @Rob! :gigipixel: Thanks so much for reaching out - I'm going to look into this with our engineers and get back to you with a response ASAP. Thanks for your patience!

stebenz•1/6/25, 1:46 PM

Hi @Rob could you please check that the "Username and Password allowed" option is checked both in the Default Settings as well as in the Organization level settings?

stebenz•1/6/25, 1:48 PM

Ok, then let me quickly look into what is happening here.

stebenz•1/6/25, 2:05 PM

Is the linked IDP still active?

stebenz•1/6/25, 2:22 PM

Do you use any OIDC scopes?

stebenz•1/6/25, 2:42 PM

To start the OIDC flow, but is irrelevant if you want to login to the console

stebenz•1/6/25, 4:29 PM

There is already an issue regarding this topic around fallback handling in the login, refer to https://github.com/zitadel/zitadel/issues/6466.
In the meantime, we are working on a fix to solve your problem, I will keep you updated.

GitHub

Prompt for authentication method · Issue #6466 · zitadel/zitadel

Preflight Checklist I could not find a solution in the existing issues, docs, nor discussions I have joined the ZITADEL chat Describe your problem Given I have configured an IDP while allowing pass...

stebenz•1/8/25, 2:40 PM

yes, we merged https://github.com/zitadel/zitadel/pull/9136, which will be available in the next release

stebenz•1/8/25, 2:43 PM

With this if you disallow the external login, you will not be redirected to the external IDP.
That you always get the selection of password or IDP, unfortunately you would need to wait for the before mentioned PR.

stebenz•1/14/25, 4:16 PM

https://github.com/zitadel/zitadel/pull/9178 , I'm literally in the process of reviewing the fix right now, which means there should be a release shortly

GitHub

fix(login): allow fallback to local auth in case of IdP errors by l...

Which Problems Are Solved
The current login will always prefer external authentication (through an IdP) over local authentication. So as soon as either the user had connected to an IdP or even when...

RRob @stebenz I saw it was released early last week in v2.68.0, when will the Zitadel...

stebenz•1/28/25, 9:47 AM

I will quickly ask internally, let me get back to you.

RRob @stebenz I saw it was released early last week in v2.68.0, when will the Zitadel...

stebenz•1/28/25, 9:48 AM

Thursday

RRob @stebenz Update is live and we just tried and there is 0 change in behaviour.......

stebenz•1/30/25, 10:05 AM

IDP first is still the plan, but you should get a password login when you return form the failed external IDP login.

Is username and password login enabled in the settings?
Does the respective user have a password or passkey set?

stebenz•1/30/25, 1:29 PM

The problem is here that you get stuck on the IDP login, if you would come back to Zitadel with an error, as it should be as the login was not successful, then you could use your password.
The current login expects if you logged in with an IDP, you should be able do login again, if not you should return with an error.

It's unfortunate but I can only propose to create an issue and/or support request regarding this problem of improper error handling of IDPs

stebenz•1/30/25, 3:19 PM

If it's a newly created user you still can select IDP or type in the username and then login with password.
This didn't change at all

stebenz•1/30/25, 5:42 PM

The logic for auto redirect to external IDPs was implemented already some time ago, so to further improve on the SSO functionality.