Login V2: gRPC call to zitadel.user.v2.UserService.ListUsers returns 403, organization scoped

Use-case: Multi tenancy PaaS
Environment: Self hosting
Version: 4.5.0 and 4.6.2 in beta envs, 3.3.0 in production (using old zitadel/typescript repo)

Hello everyone,

Not sure if it's reproducible as well for some of you, but gRPC call to zitadel.user.v2.UserService.ListUsers endpoint returns a 403 permission_denied error to the Login V2 application when
the URL contains a pre-defined

organization

organization

organization

organization query param resolved from scopes from the auth request, AND most strangely only for one same user email, even after deleteing + recreating the user.

 Error [ConnectError]: [permission_denied] HTTP 403
    at <unknown> (.next/server/chunks/5397.js:10:108067)
    at v (.next/server/chunks/5397.js:10:108544)
    at next (.next/server/chunks/5397.js:10:144756)
    at async Object.unary (.next/server/chunks/5397.js:10:144015)
    at async Object.i [as listUsers] (.next/server/chunks/5397.js:1:1763)
    at async aw (.next/server/chunks/8101.js:1:108130)
    at async s (.next/server/chunks/8101.js:1:613) {
  rawMessage: 'HTTP 403',
  code: 7,
  metadata: Headers {
    server: 'awselb/2.0',
    date: 'Wed, 29 Oct 2025 08:21:33 GMT',
    'content-type': 'application/grpc',
    'content-length': '0',
    'grpc-status': '7',
    'grpc-message': 'permission denied'
  },
  details: [],
  cause: undefined,
  digest: '2436281361'
}

 Error [ConnectError]: [permission_denied] HTTP 403
    at <unknown> (.next/server/chunks/5397.js:10:108067)
    at v (.next/server/chunks/5397.js:10:108544)
    at next (.next/server/chunks/5397.js:10:144756)
    at async Object.unary (.next/server/chunks/5397.js:10:144015)
    at async Object.i [as listUsers] (.next/server/chunks/5397.js:1:1763)
    at async aw (.next/server/chunks/8101.js:1:108130)
    at async s (.next/server/chunks/8101.js:1:613) {
  rawMessage: 'HTTP 403',
  code: 7,
  metadata: Headers {
    server: 'awselb/2.0',
    date: 'Wed, 29 Oct 2025 08:21:33 GMT',
    'content-type': 'application/grpc',
    'content-length': '0',
    'grpc-status': '7',
    'grpc-message': 'permission denied'
  },
  details: [],
  cause: undefined,
  digest: '2436281361'
}

 Error [ConnectError]: [permission_denied] HTTP 403
    at <unknown> (.next/server/chunks/5397.js:10:108067)
    at v (.next/server/chunks/5397.js:10:108544)
    at next (.next/server/chunks/5397.js:10:144756)
    at async Object.unary (.next/server/chunks/5397.js:10:144015)
    at async Object.i [as listUsers] (.next/server/chunks/5397.js:1:1763)
    at async aw (.next/server/chunks/8101.js:1:108130)
    at async s (.next/server/chunks/8101.js:1:613) {
  rawMessage: 'HTTP 403',
  code: 7,
  metadata: Headers {
    server: 'awselb/2.0',
    date: 'Wed, 29 Oct 2025 08:21:33 GMT',
    'content-type': 'application/grpc',
    'content-length': '0',
    'grpc-status': '7',
    'grpc-message': 'permission denied'
  },
  details: [],
  cause: undefined,
  digest: '2436281361'
}

 Error [ConnectError]: [permission_denied] HTTP 403
    at <unknown> (.next/server/chunks/5397.js:10:108067)
    at v (.next/server/chunks/5397.js:10:108544)
    at next (.next/server/chunks/5397.js:10:144756)
    at async Object.unary (.next/server/chunks/5397.js:10:144015)
    at async Object.i [as listUsers] (.next/server/chunks/5397.js:1:1763)
    at async aw (.next/server/chunks/8101.js:1:108130)
    at async s (.next/server/chunks/8101.js:1:613) {
  rawMessage: 'HTTP 403',
  code: 7,
  metadata: Headers {
    server: 'awselb/2.0',
    date: 'Wed, 29 Oct 2025 08:21:33 GMT',
    'content-type': 'application/grpc',
    'content-length': '0',
    'grpc-status': '7',
    'grpc-message': 'permission denied'
  },
  details: [],
  cause: undefined,
  digest: '2436281361'
}

The IAM_LOGIN_CLIENT manager role is granted to the Service Account used by Login V2.

Also tried adding IAM_OWNER, sadly with the same result.

Strangely, the REST endpoint /v2/users returns the expected search result.

I opened this issue for it:
https://github.com/zitadel/zitadel/issues/10995

GitHub

[Bug]: Login V2: gRPC call to zitadel.user.v2.UserService.ListUsers...

Preflight Checklist I could not find a solution in the documentation, the existing issues or discussions I have joined the ZITADEL chat Environment Self-hosted Version 3.3.0 (with custom zitadel/ty...

Login V2: gRPC call to zitadel.user.v2.UserService.ListUsers returns 403, organization scoped

Similar Threads

Similar Threads

Similar Threads