Technical Issue – Organization Domain Policy Permissions
🏬Self-hosted❓Question🛡️Authorization✅Solved
Hello,
I am encountering an issue when configuring an organization through the API, and the same restriction also appears in the ZITADEL Console.
I have users with the following instance-level roles:
*
*
With these roles, they can create organizations and manage most of their settings. However, they cannot configure the Domain Settings of an organization.
More specifically, I need to enable the
From the API, I am using the following endpoint:
This corresponds to the
When trying to configure the policy, the API returns:
The interesting part is that the same user is already allowed to create and manage organizations and domains. However, enabling
I would therefore like to understand:
1. Is there a specific permission required to modify the organization's domain policy, particularly
2. Why would a user who is allowed to create/manage an organization's domain not be allowed to enable this setting?
3. Is this an intentional security restriction?
4. Is there a recommended way to grant this capability to organization managers without giving them the full
Environment:
* ZITADEL self-hosted v4.17
The goal is to allow organization managers to fully configure their organizations, including their domain policy, without granting them excessive instance-level privileges such as
Thank you for your help.
I am encountering an issue when configuring an organization through the API, and the same restriction also appears in the ZITADEL Console.
I have users with the following instance-level roles:
*
IAM_ORG_MANAGERIAM_ORG_MANAGER*
IAM_USER_MANAGERIAM_USER_MANAGERWith these roles, they can create organizations and manage most of their settings. However, they cannot configure the Domain Settings of an organization.
More specifically, I need to enable the
userLoginMustBeDomainuserLoginMustBeDomain setting.From the API, I am using the following endpoint:
POST /admin/v1/orgs/{org_id}/policies/domainPOST /admin/v1/orgs/{org_id}/policies/domainThis corresponds to the
AddCustomDomainPolicyAddCustomDomainPolicy operation.When trying to configure the policy, the API returns:
The interesting part is that the same user is already allowed to create and manage organizations and domains. However, enabling
userLoginMustBeDomainuserLoginMustBeDomain appears to require additional permissions that are not covered by IAM_ORG_MANAGERIAM_ORG_MANAGER / IAM_USER_MANAGERIAM_USER_MANAGER.I would therefore like to understand:
1. Is there a specific permission required to modify the organization's domain policy, particularly
userLoginMustBeDomainuserLoginMustBeDomain?2. Why would a user who is allowed to create/manage an organization's domain not be allowed to enable this setting?
3. Is this an intentional security restriction?
4. Is there a recommended way to grant this capability to organization managers without giving them the full
IAM_OWNERIAM_OWNER role?Environment:
* ZITADEL self-hosted v4.17
The goal is to allow organization managers to fully configure their organizations, including their domain policy, without granting them excessive instance-level privileges such as
IAM_OWNERIAM_OWNER.Thank you for your help.
