andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-08 23:25:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: add instance administrator hardening guide (#12678)

Browse Source 
# Which Problems Are Solved

- Operators lack a single guide for separating instance-level principals
(break-glass, login client) from tenant organizations.
- Login policy and IdP behavior for platform accounts is easy to
conflate with customer org settings when admins share one organization.
- There is no documented procedure to inventory instance administrators
or detect unexpected grants over time.

# How the Problems Are Solved

- Add Hardening instance administrators covering:
- Dedicated platform organization layout and why login, password, and
lockout policies matter for operator accounts.
- Login client (`IAM_LOGIN_CLIENT`) and break-glass (`IAM_OWNER`)
hygiene.
- Periodic review with Internal Permission Service v2
`ListAdministrators` (instance and platform org filters).
- Actions v2 webhooks for `instance.member.*` and `org.member.*` events
(with payload interpretation and alert hints).
- Event API polling alternative for SIEM/batch pipelines
(`instance.member.*` and platform-org `org.member.*`).
- Register the page in the docs sidebar under Roles & Permissions.
- Cross-link from administrators, production checklists, login-client
setup, and service account authentication guides.

# Additional Changes

- Clarify instance vs org IdP availability depends on effective login
policy and linked providers (not automatic for all orgs).
- Note deprecated Admin API `POST /admin/v1/members/_search` vs v2
`ListAdministrators`.

# Additional Context

- Operational hardening guide only (no product authz changes).

---------

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Livio Spring
2026-09-04 15:26:32 +02:00
committed by GitHub
co-authored by Cursor
parent 9067605b66
commit 8dac4e2b54
7 changed files with 386 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/docs/content/self-hosting/manage/login-client.mdx
+2
View File
@@ -5,6 +5,8 @@ sidebar_label: Create a Login Client
---
To enable your self-hosted Login UI to connect to the Zitadel API, it needs a token for a user with the IAM_LOGIN_CLIENT role.
Place that service account in a dedicated organization for instance administrators and follow [Hardening instance administrators](/guides/manage/console/administrator-hardening) for least-privilege and login settings alignment.
On new installations, the Zitadel setup job can be configured to automatically write a Personal Access Token (PAT) for the login client.
Check out [one of the deployment examples](https://zitadel.com/docs/self-hosting/deploy/overview) to learn how to do this.
apps/docs/content/self-hosting/manage/productionchecklist.mdx
+1
View File
@@ -52,6 +52,7 @@ To apply best practices to your production setup we created a step by step check
- [ ] Ensure that your ZITADEL does not use [the default, example or _easy-to-guess_ credentials](/self-hosting/manage/database#zitadel-credentials)
- [ ] Use a FQDN and a trusted valid certificate for external [TLS](/self-hosting/manage/tls_modes) connections
- [ ] Create service accounts for applications that interact with ZITADEL's APIs
- [ ] Isolate instance administrators and the login client in a [dedicated organization for instance administrators](/guides/manage/console/administrator-hardening) with login and lockout settings suited for instance administrators
- [ ] Make use of a CDN service to decrease the load for static assets served by ZITADEL
- [ ] Make use of a [security scanner](https://owasp.org/www-community/Vulnerability_Scanning_Tools) to test your application and deployment environment