SSO email case-sensitive
πAuthenticationβοΈZitadel Cloudπͺ²BugsβQuestionβ
Solved
Use-case: We use Zitadel as authentication for our internal tools, with Microsoft Entra connected as an external IdP for SSO.
Environment: Zitadel Cloud
What you expected to happen: I have an existing Zitadel user with the email peshkoa@example.org. I connected our company's Microsoft Entra as an IdP. I expected to log in via SSO and have Zitadel link my Entra identity to my existing Zitadel account based on matching email.
What went wrong: In Entra, our account is stored with the casing PeshkoA@example.org. Because the email casing differs from what's stored in Zitadel (peshkoa@example.org), Zitadel doesn't recognize it as the same user. Instead of linking the two accounts, it treats the email as case-sensitive, assumes no matching account exists, and attempts to create a new user - which then fails, most likely due to a unique constraint on email in the database.
This means any user whose IdP email casing doesn't exactly match the casing stored in Zitadel cannot log in via SSO, even though the email address is functionally the same. Since email addresses are conventionally treated as case-insensitive (RFC 5321 aside, virtually every mail provider and IdP treats them this way in practice), we'd expect Zitadel to normalize case when matching/linking accounts during SSO login.
Is there a way to configure case-insensitive email matching for IdP account linking? If not, is there a plan to implement this? We'd prefer not to have to manually reconcile casing between our Zitadel user records and whatever casing happens to be set in Entra for each user.
Environment: Zitadel Cloud
What you expected to happen: I have an existing Zitadel user with the email peshkoa@example.org. I connected our company's Microsoft Entra as an IdP. I expected to log in via SSO and have Zitadel link my Entra identity to my existing Zitadel account based on matching email.
What went wrong: In Entra, our account is stored with the casing PeshkoA@example.org. Because the email casing differs from what's stored in Zitadel (peshkoa@example.org), Zitadel doesn't recognize it as the same user. Instead of linking the two accounts, it treats the email as case-sensitive, assumes no matching account exists, and attempts to create a new user - which then fails, most likely due to a unique constraint on email in the database.
This means any user whose IdP email casing doesn't exactly match the casing stored in Zitadel cannot log in via SSO, even though the email address is functionally the same. Since email addresses are conventionally treated as case-insensitive (RFC 5321 aside, virtually every mail provider and IdP treats them this way in practice), we'd expect Zitadel to normalize case when matching/linking accounts during SSO login.
Is there a way to configure case-insensitive email matching for IdP account linking? If not, is there a plan to implement this? We'd prefer not to have to manually reconcile casing between our Zitadel user records and whatever casing happens to be set in Entra for each user.
