Domain discovery fallback to an configurable OIDC provider instead of local login
⚙️Configuration🏬Self-hosted❌Unsolved➕Feature Request🔗OIDC
Hey 
I originally posted this scenario here:
https://github.com/zitadel/zitadel/issues/10662#issuecomment-4084688836
Attaching the flow again below for context.
Main problem:
Our users are running into UX issues because they confuse the ZITADEL local login with the email+password login of our application (via OIDC).
From their perspective:
they see “email + password”
but don’t realize this is NOT our app login, but ZITADEL local auth
What we actually want:
Keep the identifier (email) step for domain discovery
But do NOT expose local password login on the default org
Instead:
enterprise users → redirected via domain discovery (e.g. Entra)
normal users → go to our OIDC login directly or get redirected by the fallback
only real local users → get local password prompt
Important detail:
local users only exist in our setup via API/Terraform (e.g. admins / root org)
so showing password broadly is misleading UX
Nice-to-have behavior:
After entering the email:
only route to local password if the user is actually a local user
otherwise continue with domain discovery or OIDC
Right now it seems we need to enable username/password on the default org to make this work, which is exactly what we want to avoid.
Curious if others ran into something similar or if there’s a recommended pattern for this in Login V1
I originally posted this scenario here:
https://github.com/zitadel/zitadel/issues/10662#issuecomment-4084688836
Attaching the flow again below for context.
Main problem:
Our users are running into UX issues because they confuse the ZITADEL local login with the email+password login of our application (via OIDC).
From their perspective:
they see “email + password”
but don’t realize this is NOT our app login, but ZITADEL local auth
What we actually want:
Keep the identifier (email) step for domain discovery
But do NOT expose local password login on the default org
Instead:
enterprise users → redirected via domain discovery (e.g. Entra)
normal users → go to our OIDC login directly or get redirected by the fallback
only real local users → get local password prompt
Important detail:
local users only exist in our setup via API/Terraform (e.g. admins / root org)
so showing password broadly is misleading UX
Nice-to-have behavior:
After entering the email:
only route to local password if the user is actually a local user
otherwise continue with domain discovery or OIDC
Right now it seems we need to enable username/password on the default org to make this work, which is exactly what we want to avoid.
Curious if others ran into something similar or if there’s a recommended pattern for this in Login V1
GitHub![[Bug]: Domain Discovery doesn't work · Issue #10662 · zitadel/zit...](https://cdn.answeroverflow.com/embeds/1492117988470689792/0/thumbnail.png)
Preflight Checklist I could not find a solution in the documentation, the existing issues or discussions I have joined the ZITADEL chat Environment Self-hosted Version v4.1.2 Database PostgreSQL Da...
