Unable to change password

A

Ask Inkeep•12/7/25, 2:38 PM

Hi @Titouan-Joseph, I'm an AI assistant for ZITADEL. While a team member reviews this question, I'll see if I can find relevant sources for your question.

A

Ask Inkeep•12/7/25, 2:38 PM

Answer

I wasn't able to find a direct answer, here are some relevant sources:

ZITADEL Default Settings : This explains that password expiry settings force users to change their password during the next authentication after expiration. (1)
Add Password Age Settings : This API documentation shows how password expiry is configured, with
```
maxAgeDays
```
maxAgeDays
```
maxAgeDays
```
maxAgeDays
defining when passwords expire and
```
expireWarnDays
```
expireWarnDays
```
expireWarnDays
```
expireWarnDays
for warning notifications. (2)

The issue you're describing—where users registered via IDP are prompted for password changes despite not having passwords—appears to be a configuration mismatch. Password expiry policies apply to password-based authentication, but users authenticated exclusively through external IDPs don't have passwords in ZITADEL to expire. (1)

Would you like me to provide a general answer based on my knowledge about how to handle this scenario?

A

Ask Inkeep•12/7/25, 2:38 PM

To learn more, see the sources I considered:

[1] ZITADEL Default Settings
[2] Add Password Age Settings

A

Ask Inkeep•12/7/25, 2:38 PM

Feel free to tag @Ask Inkeep with additional questions.

AAsk Inkeep To learn more, see the sources I considered: [[1] ZITADEL Default Settings](h...

A

Ask InkeepAPP•12/7/25, 2:44 PM

Got it. Tagging @Rajat for additional help.

TTitouan-Joseph Hello team, I'm on a self hosted instance with docker and traefik as reverse pr...

R

Rajat•12/8/25, 10:05 AM

hey @Titouan-Joseph have you tried the same behaviour with v2 login too?.

T

Titouan-JosephOP•12/8/25, 10:09 AM

Not tried with login V2
And I'm not sure it's ready for the production there is some issues that not fit my deployment

https://discord.com/channels/927474939156643850/1387445314767814818/1437160496183775316

T

Titouan-JosephOP•12/8/25, 10:10 AM

Hi guys,
Sorry, I've been less active these past few months, with a lot to do for work and my associative commitments

I just updated from v3.4.3 to v4.6.4 and tested the V2 login a little

I noticed that it wasn't possible to log in with the email or username when the user has an external IDP registered
The second thing I noticed was that for my existing integrations, the workflow does not allow me to select the user when there are multiple users logged in. I'm not sure if I missed something in my configuration.

T

Titouan-JosephOP•12/8/25, 10:12 AM

The major issue with the login V2, I think, it's the auto redirection that remove the interaction with the UI

R

Rajat•12/8/25, 10:23 AM

ah okay, thanks for mentioning that thread, I will update the team.

R

Rajat•12/8/25, 10:24 AM

it could be because the feature is still in beta and has been overlooked

T

Titouan-JosephOP•12/8/25, 10:38 AM

Sure no problem !
I will try to deploy a testing instance with login V2 and an IDP configured with a password expiring policy
And try to come back to you with my findings

T

Titouan-JosephOP•12/8/25, 10:39 AM

In the same time, is that possible to check the feasibility to not automatically redirect to the IDP login page if the user use an IDP ?

TTitouan-Joseph In the same time, is that possible to check the feasibility to not automatically...

R

Rajat•12/8/25, 10:50 AM

no i don't think so its possible like you want BUT you can change the Login Lifetimes which altho doesn't do the same thing but something very smilar. I hope this helps as a arkaround

T

Titouan-JosephOP•12/8/25, 10:54 AM

Oh !
That means, if the time is reached there is no auto redirection to the IDP ?

R

Rajat•12/8/25, 10:57 AM

exactly

T

Titouan-JosephOP•12/8/25, 10:59 AM

Perfect, I will try this !
Thank you @Rajat

R

Rajat•12/15/25, 4:41 PM

hey @Titouan-Joseph if it helped, you can mark my answer with

and it will auto close this thread. Thanks

T

Titouan-JosephOP•12/15/25, 5:25 PM

Hi @Rajat
Not sure that resolved the issue
I configure the

external_login_check_lifetime

external_login_check_lifetime

external_login_check_lifetime

external_login_check_lifetime to 10h instead of 240h and the auto redirect to the IDP is always here. Even if I wait for more than 10h

I use terraform for this, if you want to check the repo is here https://gitlab.com/24-heures-insa/infra/-/blob/main/terraform/zitadel/14_login_policies.tf?ref_type=heads#L11

GitLab

terraform/zitadel/14_login_policies.tf · main · 24 heures INSA / ...

GitLab.com

T

Titouan-JosephOP•12/15/25, 5:26 PM

Can I ask the reason why zitadel auto redirects to the IDP login ?
I think if the user tap his username it to fill his own password and don't want to use the IDP for this time

T

Titouan-JosephOP•12/15/25, 5:27 PM

And I think I there is an issue with the IDP auto redirect to IDP can broke the login workflow

T

Titouan-JosephOP•12/16/25, 8:50 AM

Hey @Rajat,

Here is the response of the API about the Login policy

{
    "policy": {
        "details": {
            "sequence": "115",
            "creationDate": "2024-07-25T19:55:38.892206Z",
            "changeDate": "2025-12-12T21:52:15.540092Z",
            "resourceOwner": "xxx"
        },
        "allowUsernamePassword": true,
        "allowRegister": true,
        "allowExternalIdp": true,
        "passwordlessType": "PASSWORDLESS_TYPE_ALLOWED",
        "passwordCheckLifetime": "864000s",
        "externalLoginCheckLifetime": "36000s",
        "mfaInitSkipLifetime": "2592000s",
        "secondFactorCheckLifetime": "86400s",
        "multiFactorCheckLifetime": "86400s",
        "secondFactors": [
            "SECOND_FACTOR_TYPE_OTP",
            "SECOND_FACTOR_TYPE_U2F"
        ],
        "multiFactors": [
            "MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"
        ],
        "idps": [
            {
                "idpId": "xxx",
                "idpName": "Google"
            },
            {
                "idpId": "xxx",
                "idpName": "GitLab"
            },
            {
                "idpId": "xxx",
                "idpName": "GitHub"
            }
        ],
        "allowDomainDiscovery": true,
        "disableLoginWithPhone": true
    }
}

{
    "policy": {
        "details": {
            "sequence": "115",
            "creationDate": "2024-07-25T19:55:38.892206Z",
            "changeDate": "2025-12-12T21:52:15.540092Z",
            "resourceOwner": "xxx"
        },
        "allowUsernamePassword": true,
        "allowRegister": true,
        "allowExternalIdp": true,
        "passwordlessType": "PASSWORDLESS_TYPE_ALLOWED",
        "passwordCheckLifetime": "864000s",
        "externalLoginCheckLifetime": "36000s",
        "mfaInitSkipLifetime": "2592000s",
        "secondFactorCheckLifetime": "86400s",
        "multiFactorCheckLifetime": "86400s",
        "secondFactors": [
            "SECOND_FACTOR_TYPE_OTP",
            "SECOND_FACTOR_TYPE_U2F"
        ],
        "multiFactors": [
            "MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"
        ],
        "idps": [
            {
                "idpId": "xxx",
                "idpName": "Google"
            },
            {
                "idpId": "xxx",
                "idpName": "GitLab"
            },
            {
                "idpId": "xxx",
                "idpName": "GitHub"
            }
        ],
        "allowDomainDiscovery": true,
        "disableLoginWithPhone": true
    }
}

{
    "policy": {
        "details": {
            "sequence": "115",
            "creationDate": "2024-07-25T19:55:38.892206Z",
            "changeDate": "2025-12-12T21:52:15.540092Z",
            "resourceOwner": "xxx"
        },
        "allowUsernamePassword": true,
        "allowRegister": true,
        "allowExternalIdp": true,
        "passwordlessType": "PASSWORDLESS_TYPE_ALLOWED",
        "passwordCheckLifetime": "864000s",
        "externalLoginCheckLifetime": "36000s",
        "mfaInitSkipLifetime": "2592000s",
        "secondFactorCheckLifetime": "86400s",
        "multiFactorCheckLifetime": "86400s",
        "secondFactors": [
            "SECOND_FACTOR_TYPE_OTP",
            "SECOND_FACTOR_TYPE_U2F"
        ],
        "multiFactors": [
            "MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"
        ],
        "idps": [
            {
                "idpId": "xxx",
                "idpName": "Google"
            },
            {
                "idpId": "xxx",
                "idpName": "GitLab"
            },
            {
                "idpId": "xxx",
                "idpName": "GitHub"
            }
        ],
        "allowDomainDiscovery": true,
        "disableLoginWithPhone": true
    }
}

{
    "policy": {
        "details": {
            "sequence": "115",
            "creationDate": "2024-07-25T19:55:38.892206Z",
            "changeDate": "2025-12-12T21:52:15.540092Z",
            "resourceOwner": "xxx"
        },
        "allowUsernamePassword": true,
        "allowRegister": true,
        "allowExternalIdp": true,
        "passwordlessType": "PASSWORDLESS_TYPE_ALLOWED",
        "passwordCheckLifetime": "864000s",
        "externalLoginCheckLifetime": "36000s",
        "mfaInitSkipLifetime": "2592000s",
        "secondFactorCheckLifetime": "86400s",
        "multiFactorCheckLifetime": "86400s",
        "secondFactors": [
            "SECOND_FACTOR_TYPE_OTP",
            "SECOND_FACTOR_TYPE_U2F"
        ],
        "multiFactors": [
            "MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"
        ],
        "idps": [
            {
                "idpId": "xxx",
                "idpName": "Google"
            },
            {
                "idpId": "xxx",
                "idpName": "GitLab"
            },
            {
                "idpId": "xxx",
                "idpName": "GitHub"
            }
        ],
        "allowDomainDiscovery": true,
        "disableLoginWithPhone": true
    }
}

T

Titouan-JosephOP•12/16/25, 9:05 AM

I have just tested with
password_check_lifetime = "0h0m0s"
external_login_check_lifetime = "0h0m0s"

And the loop is always here, when I put the user on the login page then I click next, this redirect me to IDP login page

T

Titouan-JosephOP•12/16/25, 9:10 AM

Terraform modification check with the API

{
    "policy": {
        "details": {
            "sequence": "118",
            "creationDate": "2024-07-25T19:55:38.892206Z",
            "changeDate": "2025-12-16T09:04:00.667473Z",
            "resourceOwner": "xxx"
        },
        "allowUsernamePassword": true,
        "allowRegister": true,
        "allowExternalIdp": true,
        "passwordlessType": "PASSWORDLESS_TYPE_ALLOWED",
        "passwordCheckLifetime": "0s",
        "externalLoginCheckLifetime": "0s",
        "mfaInitSkipLifetime": "2592000s",
        "secondFactorCheckLifetime": "86400s",
        "multiFactorCheckLifetime": "86400s",
        "secondFactors": [
            "SECOND_FACTOR_TYPE_OTP",
            "SECOND_FACTOR_TYPE_U2F"
        ],
        "multiFactors": [
            "MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"
        ],
        "idps": [
            {
                "idpId": "xxx",
                "idpName": "Google"
            },
            {
                "idpId": "xxx",
                "idpName": "GitLab"
            },
            {
                "idpId": "xxx",
                "idpName": "GitHub"
            }
        ],
        "allowDomainDiscovery": true,
        "disableLoginWithPhone": true
    }
}

{
    "policy": {
        "details": {
            "sequence": "118",
            "creationDate": "2024-07-25T19:55:38.892206Z",
            "changeDate": "2025-12-16T09:04:00.667473Z",
            "resourceOwner": "xxx"
        },
        "allowUsernamePassword": true,
        "allowRegister": true,
        "allowExternalIdp": true,
        "passwordlessType": "PASSWORDLESS_TYPE_ALLOWED",
        "passwordCheckLifetime": "0s",
        "externalLoginCheckLifetime": "0s",
        "mfaInitSkipLifetime": "2592000s",
        "secondFactorCheckLifetime": "86400s",
        "multiFactorCheckLifetime": "86400s",
        "secondFactors": [
            "SECOND_FACTOR_TYPE_OTP",
            "SECOND_FACTOR_TYPE_U2F"
        ],
        "multiFactors": [
            "MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"
        ],
        "idps": [
            {
                "idpId": "xxx",
                "idpName": "Google"
            },
            {
                "idpId": "xxx",
                "idpName": "GitLab"
            },
            {
                "idpId": "xxx",
                "idpName": "GitHub"
            }
        ],
        "allowDomainDiscovery": true,
        "disableLoginWithPhone": true
    }
}

{
    "policy": {
        "details": {
            "sequence": "118",
            "creationDate": "2024-07-25T19:55:38.892206Z",
            "changeDate": "2025-12-16T09:04:00.667473Z",
            "resourceOwner": "xxx"
        },
        "allowUsernamePassword": true,
        "allowRegister": true,
        "allowExternalIdp": true,
        "passwordlessType": "PASSWORDLESS_TYPE_ALLOWED",
        "passwordCheckLifetime": "0s",
        "externalLoginCheckLifetime": "0s",
        "mfaInitSkipLifetime": "2592000s",
        "secondFactorCheckLifetime": "86400s",
        "multiFactorCheckLifetime": "86400s",
        "secondFactors": [
            "SECOND_FACTOR_TYPE_OTP",
            "SECOND_FACTOR_TYPE_U2F"
        ],
        "multiFactors": [
            "MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"
        ],
        "idps": [
            {
                "idpId": "xxx",
                "idpName": "Google"
            },
            {
                "idpId": "xxx",
                "idpName": "GitLab"
            },
            {
                "idpId": "xxx",
                "idpName": "GitHub"
            }
        ],
        "allowDomainDiscovery": true,
        "disableLoginWithPhone": true
    }
}

{
    "policy": {
        "details": {
            "sequence": "118",
            "creationDate": "2024-07-25T19:55:38.892206Z",
            "changeDate": "2025-12-16T09:04:00.667473Z",
            "resourceOwner": "xxx"
        },
        "allowUsernamePassword": true,
        "allowRegister": true,
        "allowExternalIdp": true,
        "passwordlessType": "PASSWORDLESS_TYPE_ALLOWED",
        "passwordCheckLifetime": "0s",
        "externalLoginCheckLifetime": "0s",
        "mfaInitSkipLifetime": "2592000s",
        "secondFactorCheckLifetime": "86400s",
        "multiFactorCheckLifetime": "86400s",
        "secondFactors": [
            "SECOND_FACTOR_TYPE_OTP",
            "SECOND_FACTOR_TYPE_U2F"
        ],
        "multiFactors": [
            "MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"
        ],
        "idps": [
            {
                "idpId": "xxx",
                "idpName": "Google"
            },
            {
                "idpId": "xxx",
                "idpName": "GitLab"
            },
            {
                "idpId": "xxx",
                "idpName": "GitHub"
            }
        ],
        "allowDomainDiscovery": true,
        "disableLoginWithPhone": true
    }
}