andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-06 06:12:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: handle Zitadel provider IdP login via login v1 (#12469)

Browse Source 
# Which Problems Are Solved

This PR adds support for using a ZITADEL IdP provider in the login v1 UI
flow and conditionally grants a support-user instance membership based
on a ZITADEL-specific project-roles token claim.

# How the Problems Are Solved

- Introduced ZITADEL IdP handling in the login v1 handler, including
extracting the `urn:zitadel:iam:org:project:roles` claim and granting
`IAM_OWNER_VIEWER` instance membership when configured orgs match.
- Added a new `AddInstanceMemberFromLogin` to assign an instance
membership during the login v1 ZITADEL-IdP flow without permission
checks (as the authorization is established based on the project roles
in the token claim)
- Added unit tests

# Additional Changes

N/A

# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/12446
This commit is contained in:
gayathri
2026-07-28 15:20:46 +02:00
committed by GitHub
parent 318acd4bc3
commit ffd9b39bdb
14 changed files with 908 additions and 492 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proto/zitadel/management.proto
+8 -6
View File
@@ -14128,9 +14128,10 @@ message AddZitadelProviderRequest {
];
zitadel.idp.v1.Options provider_options = 6;
// Optionally specify the details (organization_id, organization_domain) related to instance roles.
// It is used to determine if a user should be assigned instance administrator roles after authenticating with the provider.
repeated zitadel.idp.v1.InstanceRolesInfo instance_roles_info = 7 [(validate.rules).repeated = {max_items: 20}];
// field 7 previously held instance_roles_info, which was removed as it allowed
// org-scoped providers to grant instance-wide role memberships on login.
reserved 7;
reserved "instance_roles_info";
}
message AddZitadelProviderResponse {
@@ -14182,9 +14183,10 @@ message UpdateZitadelProviderRequest {
];
zitadel.idp.v1.Options provider_options = 7;
// Optionally specify the details (organization_id, organization_domain) related to instance roles.
// It is used to determine if a user should be assigned instance administrator roles after authenticating with the provider.
repeated zitadel.idp.v1.InstanceRolesInfo instance_roles_info = 8 [(validate.rules).repeated = {max_items: 20}];
// field 8 previously held instance_roles_info, which was removed as it allowed
// org-scoped providers to grant instance-wide role memberships on login.
reserved 8;
reserved "instance_roles_info";
}
message UpdateZitadelProviderResponse {