Listing SystemAPIUsers, debugging SystemAPIUsers
⚙️Configuration🏬Self-hosted⛓️💥APIs❓Question✅Solved
Hello,
I'm trying to create a SystemAPIUser. I've at first followed the documentation in https://zitadel.com/docs/guides/integrate/zitadel-apis/access-zitadel-system-api which doesn't work. Besides, posts like https://github.com/zitadel/zitadel/issues/7937#issuecomment-3082244785 ("Don't trust zitadel-tools") suggest it is wrong anyways. There have been various suggestions that the documentation is also wrong about the username for the system user, which might have to be the instance url (questions-help-bugsJWT for System API Call). Also, the iss (issuer) and sub fields might have to be the url instead of the username. Or maybe equal to the username. Long story short, I'm confused and nothing works.
Now I'm trying to start at the beginning: Configure a SystemAPIUser. To check if it is really created on the initialisation of a new instance, I've set
So the next question would be how I would list the SystemAPIUsers that do exist? How do I do that without an existing SystemAPIUser? I've tried setting some unique username and grepping for that in the output of
I'm trying to create a SystemAPIUser. I've at first followed the documentation in https://zitadel.com/docs/guides/integrate/zitadel-apis/access-zitadel-system-api which doesn't work. Besides, posts like https://github.com/zitadel/zitadel/issues/7937#issuecomment-3082244785 ("Don't trust zitadel-tools") suggest it is wrong anyways. There have been various suggestions that the documentation is also wrong about the username for the system user, which might have to be the instance url (questions-help-bugsJWT for System API Call). Also, the iss (issuer) and sub fields might have to be the url instead of the username. Or maybe equal to the username. Long story short, I'm confused and nothing works.
Now I'm trying to start at the beginning: Configure a SystemAPIUser. To check if it is really created on the initialisation of a new instance, I've set
inotifywatchinotifywatch on the public key file specified in defaults.yamldefaults.yaml as well as on defaults.yamldefaults.yaml and steps.yamlsteps.yaml. It seems that both yaml files are opened, but the public key file isn't. I can also verify that the yaml files are parsed by introducing syntax errors or removing read permissions, in both cases I get log entries, for syntax errors initialisation also fails.So the next question would be how I would list the SystemAPIUsers that do exist? How do I do that without an existing SystemAPIUser? I've tried setting some unique username and grepping for that in the output of
pg_dumpallpg_dumpall, but there is nothing in there. What else could I do to debug this?GitHub
Acceptance criteria Unify the the VerifySystemToken with VerifyAccessToken and return a single error Resolve the different keysources on query level (yaml for system user vs DB for regular user) Or...
