Microsoft Entra ID: eager create users in Extranal Authentication action doesn't quite work
This is for Zitadel 4.3.0, self-hosted.
We are building an integration with Microsoft Entra ID. The use-case is for customers of our SaaS will have their Microsoft Entra Tenant ID whitelisted in our system. Once a user from an allowed Microsoft Entra ID tenant logs in, we want to automatically provision the user and give them the appropriate roles in Zitadel, then log them in.
This is the flow we are trying to implement:
- Zitadel login (v1 UI): user enters their email, the email domain matches an organization we have setup Microsoft Entra ID for, so a "Login with Microsoft Entra ID" button appears
- User clicks that Microsoft button, logs in over at Microsoft Entra ID, and returns to Zitadel
- We have a v1 Action setup on External Authentication for the organization, which makes a blocking HTTP call to an internal system we have built. In that internal system:
- We verify the Microsoft Entra tenant is one with a paid subscription, lookup their access level and within the call will call back to the Zitadel API to create the User in Zitadel, and add the relevant roles to the User. Once the External Authentication Action completes, a user exists in Zitadel with the email-address returned from Microsoft Entra ID.
- What we would like to happen next: user is silently and automatically logged in, as their user account exists and has access to a relevant system
- What actually happens next: the "sign up" user form is shown, and the user ends up in a "account already exists" error state in the UI.
What do we seem to be missing in our understanding or setup for this to be as smooth and elegant as things usually are in Zitadel? Would trying out the beta Actions v2 be any help? If Actions v2 are indicated, what triggers/flow would be relevant to build upon?
We are building an integration with Microsoft Entra ID. The use-case is for customers of our SaaS will have their Microsoft Entra Tenant ID whitelisted in our system. Once a user from an allowed Microsoft Entra ID tenant logs in, we want to automatically provision the user and give them the appropriate roles in Zitadel, then log them in.
This is the flow we are trying to implement:
- Zitadel login (v1 UI): user enters their email, the email domain matches an organization we have setup Microsoft Entra ID for, so a "Login with Microsoft Entra ID" button appears
- User clicks that Microsoft button, logs in over at Microsoft Entra ID, and returns to Zitadel
- We have a v1 Action setup on External Authentication for the organization, which makes a blocking HTTP call to an internal system we have built. In that internal system:
- We verify the Microsoft Entra tenant is one with a paid subscription, lookup their access level and within the call will call back to the Zitadel API to create the User in Zitadel, and add the relevant roles to the User. Once the External Authentication Action completes, a user exists in Zitadel with the email-address returned from Microsoft Entra ID.
- What we would like to happen next: user is silently and automatically logged in, as their user account exists and has access to a relevant system
- What actually happens next: the "sign up" user form is shown, and the user ends up in a "account already exists" error state in the UI.
What do we seem to be missing in our understanding or setup for this to be as smooth and elegant as things usually are in Zitadel? Would trying out the beta Actions v2 be any help? If Actions v2 are indicated, what triggers/flow would be relevant to build upon?
