* fix(security): prevent unauthenticated IDP-linking account takeover
Two distinct defects allowed an attacker to bind their own external
identity to a victim's account and, because external IDP links are
globally unique (first claim wins), hijack the victim's future
federated logins.
LoginV2: resolveUserIdFromSession returned the session's user id after
only a null check, trusting an "identify-only" session (login name
submitted, no verified primary factor). An unauthenticated attacker who
knew a victim's login name could drive explicit linking against that
session. Gate it on isSessionValid so only a fully authenticated
session can link.
Backend: AddUserIDPLink skipped the user-write permission check when the
caller targeted their own account (userID == ctx user). Because the
external subject is caller-supplied and unverified, this let any
authenticated user self-link an unproven identity. Make the permission
check unconditional. The login/federation flow uses a service account
(userID != ctx user) and already took the permission branch, so it is
unaffected; verified self-service linking goes through the IDP-intent
flow.
Adds a LoginV2 regression test (identify-only session is rejected) and
the first command-level test for AddUserIDPLink (self-link without
permission is denied).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
* test(user_idp_link): address review on AddUserIDPLink hardening
- add success regression cases for AddUserIDPLink (self-link with
permission, other-user link with permission) so the login-client and
managed-admin paths are pinned and the assert.NoError branch is live
- add an integration case: UserCTX self-linking on its own account is
now denied
- document the intentional no-permission-check invariant on
BulkAddedUserIDPLinks (verified Login V1 flow only; not API-exposed)
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RUhwzSqHhycHNAJEfMcrdd
* fix(login): authorize IDP linking via enrollment guard, not isSessionValid
Replace the isSessionValid gate in resolveUserIdFromSession with
getEnrollmentAuthorizationError. isSessionValid requires a verified
primary factor, which rejected the legitimate "link an IDP as the first
authenticator" onboarding flow (a freshly verified user with no
credentials yet). The enrollment guard authorizes when the session has a
verified, non-expired primary factor OR the user has zero auth methods
and passed the user-verification check (email/invite-code proof bound to
the browser fingerprint) — closing the identify-only ATO while preserving
first-authenticator linking.
Replace the single mocked rejection test with four that run the real
guard: identify-only + has credentials -> rejected; identify-only + no
credentials + no verification check -> rejected; expired primary factor
-> rejected; identify-only + no credentials + verification check ->
allowed.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T24WwsRLbaC7aHxBmyznnd
---------
Co-authored-by: Claude Opus 4.8 <[email protected]>
# Which Problems Are Solved
The commands for the resource based v2beta AuthorizationService API are
added.
Authorizations, previously knows as user grants, give a user in a
specific organization and project context roles.
The project can be owned or granted.
The given roles can be used to restrict access within the projects
applications.
The commands for the resource based v2beta InteralPermissionService API
are added.
Administrators, previously knows as memberships, give a user in a
specific organization and project context roles.
The project can be owned or granted.
The give roles give the user permissions to manage different resources
in Zitadel.
API definitions from https://github.com/zitadel/zitadel/issues/9165 are
implemented.
Contains endpoints for user metadata.
# How the Problems Are Solved
### New Methods
- CreateAuthorization
- UpdateAuthorization
- DeleteAuthorization
- ActivateAuthorization
- DeactivateAuthorization
- ListAuthorizations
- CreateAdministrator
- UpdateAdministrator
- DeleteAdministrator
- ListAdministrators
- SetUserMetadata to set metadata on a user
- DeleteUserMetadata to delete metadata on a user
- ListUserMetadata to query for metadata of a user
## Deprecated Methods
### v1.ManagementService
- GetUserGrantByID
- ListUserGrants
- AddUserGrant
- UpdateUserGrant
- DeactivateUserGrant
- ReactivateUserGrant
- RemoveUserGrant
- BulkRemoveUserGrant
### v1.AuthService
- ListMyUserGrants
- ListMyProjectPermissions
# Additional Changes
- Permission checks for metadata functionality on query and command side
- correct existence checks for resources, for example you can only be an
administrator on an existing project
- combined all member tables to singular query for the administrators
- add permission checks for command an query side functionality
- combined functions on command side where necessary for easier
maintainability
# Additional Context
Closes#9165
---------
Co-authored-by: Elio Bischof <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
# Which Problems Are Solved
As of now, **automatic creation** and **automatic linking options** were
only considered if the corresponding **allowed option** (account
creation / linking allowed) was enabled.
With this PR, this is no longer needed and allows administrators to
address cases, where only an **automatic creation** is allowed, but
users themselves should not be allowed to **manually** create new
accounts using an identity provider or edit the information during the
process.
Also, allowing users to only link to the proposed existing account is
now possible with an enabled **automatic linking option**, while
disabling **account linking allowed**.
# How the Problems Are Solved
- Check for **automatic** options without the corresponding **allowed**
option.
- added technical advisory to notify about the possible behavior change
# Additional Changes
- display the error message on the IdP linking step in the login UI (in
case there is one)
- display an error in case no option is possible
- exchanged deprecated `eventstoreExpect` with `expectEventstore` in
touched test files
# Additional Context
closes https://github.com/zitadel/zitadel/issues/7393
---------
Co-authored-by: Stefan Benz <[email protected]>
# Which Problems Are Solved
The v2beta services are stable but not GA.
# How the Problems Are Solved
The v2beta services are copied to v2. The corresponding v1 and v2beta
services are deprecated.
# Additional Context
Closes#7236
---------
Co-authored-by: Elio Bischof <[email protected]>
# Which Problems Are Solved
This fix adds tracing spans to all V1 API import related functions. This
is to troubleshoot import related performance issues reported to us.
# How the Problems Are Solved
Add a tracing span to `api/grpc/admin/import.go` and all related
functions that are called in the `command` package.
# Additional Changes
- none
# Additional Context
- Reported by internal communication
* fix: remove resourceowner read from context in user v2 api
* fix: lint
* fix: remove orgID in addIDPLink
* fix: remove comment as unnecessary
---------
Co-authored-by: Livio Spring <[email protected]>
This implementation increases parallel write capabilities of the eventstore.
Please have a look at the technical advisories: [05](https://zitadel.com/docs/support/advisory/a10005) and [06](https://zitadel.com/docs/support/advisory/a10006).
The implementation of eventstore.push is rewritten and stored events are migrated to a new table `eventstore.events2`.
If you are using cockroach: make sure that the database user of ZITADEL has `VIEWACTIVITY` grant. This is used to query events.
* fix: restrict AllowRegistration check to local registration
* add comment
* add additional tests
* hide registration fields if no registration allowed
* fix: always allow linking and creation of external idps on users in userV2 and admin import
* chore: exclude console dist and node_module folders from cache
* chore: include node_module folders into cache again
* linting
(cherry picked from commit 66772ad0dd)
* feat: migrate external id
* implement tests and some renaming
* fix projection
* cleanup
* i18n
* fix event type
* handle migration for new services as well
* typo
(cherry picked from commit 45262e6829)
* fix(user): move check if user is existing from user idp link
* fix(user): correct unit tests for user link bulk
* fix(user): correct placement of existing user check for user link
Co-authored-by: Silvan <[email protected]>
* feat(import): add functionality to import data into an instance
* feat(import): move import to admin api and additional checks for nil pointer
* fix(export): export implementation with filtered members and grants
* fix: export and import implementation
* fix: add possibility to export hashed passwords with the user
* fix(import): import with structure of v1 and v2
* docs: add v1 proto
* fix(import): check im imported user is already existing
* fix(import): add otp import function
* fix(import): add external idps, domains, custom text and messages
* fix(import): correct usage of default values from login policy
* fix(export): fix renaming of add project function
* fix(import): move checks for unit tests
* expect filter
* fix(import): move checks for unit tests
* fix(import): move checks for unit tests
* fix(import): produce prerelease from branch
* fix(import): correctly use provided user id for machine user imports
* fix(import): corrected otp import and added guide for export and import
* fix: import verified and primary domains
* fix(import): add reading from gcs, s3 and localfile with tracing
* fix(import): gcs and s3, file size correction and error logging
* Delete docker-compose.yml
* fix(import): progress logging and count of resources
* fix(import): progress logging and count of resources
* log subscription
* fix(import): incorporate review
* fix(import): incorporate review
* docs: add suggestion for import
Co-authored-by: Fabi <[email protected]>
* fix(import): add verification otp event and handling of deleted but existing users
Co-authored-by: Livio Amstutz <[email protected]>
Co-authored-by: Fabienne <[email protected]>
Co-authored-by: Silvan <[email protected]>
Co-authored-by: Fabi <[email protected]>
* fix: rename iam command side to instance
* fix: rename iam command side to instance
* fix: rename iam command side to instance
* fix: rename iam command side to instance
* fix: rename orgiampolicy to domain policy
* fix: merge conflicts
* fix: protos
* fix: md files
* implement deprecated org iam policy again
Co-authored-by: Livio Amstutz <[email protected]>
Tim MöhlmannandGitHub
SilvanandGitHub
