# Which Problems Are Solved
The new breadcrumbs were causing problems with some more advanced
Zitadel setups. This pr removes the new breadcrumbs to revert to the old
navigation behaviour.
# How the Problems Are Solved
Most of the changes could be kept but those specific to the navigation
where mostly reverted.
# Additional Changes
Updated some dependencies.
# Additional Context
- Closes#10863
# Which Problems Are Solved
When setting a password expiry policy, users without password, e.g.
federated users, would be prompted to change their password. This was
due to two bugs, where the policy would be applied for all users.
Additionally, whenever a user was created a `PasswordChanged` timestamp
would be set, regardless if the user has a password or not.
# How the Problems Are Solved
- Only apply the password expiry check on local authentication and users
with a password (e.g. passkey only users would not be prompted)
- Only set the `PasswordChanged` timestamp for users with password
# Additional Changes
None
# Additional Context
- reported through Discord:
https://discord.com/channels/927474939156643850/1447235781717397596/1450481990808637470
- requires backport to v4.x
# Which Problems Are Solved
Naming inconsistency w.r.t the usage of Given Name / Family Name instead
of First Name / Last Name
# How the Problems Are Solved
* By replacing given and family names with first and last names in UI
and docs (not in the API definitions)
* Updated translations in multiple languages to first and last names
instead of given/family names
# Additional Changes
* Add `internal/**/*.yaml` path to the nx sources input to rebuild the
binary upon changes to these files
* Fix failing unit tests in `user_notifier_legacy_test.go` by updating
`Passwordless` with `Passkey`
# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/11308
---------
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Wim Van Laer <[email protected]>
Closes#11006
# Which Problems Are Solved
This PR addresses an issue where the ignoreUnknownUsernames setting was
not being respected in certain scenarios during the login flow.
Specifically:
- When a user was found but rejected due to login settings (e.g.,
disableLoginWithEmail), the system would return a "User not found" error
instead of redirecting to the password page as dictated by
ignoreUnknownUsernames.
- When a user was not found, and the flow fell through the registration
checks (e.g., IDP redirect failed), it would also return "User not
found" without checking ignoreUnknownUsernames.
# How the Problems Are Solved
- Introduced a helper function `handleUserNotFound` in
`apps/login/src/lib/server/loginname.ts` to centralize the logic for
checking ignoreUnknownUsernames and redirecting to the password page.
- Updated the user validation logic to call handleUserNotFound when a
user is found but rejected by policy.
- Updated the registration fallback logic to call handleUserNotFound
instead of directly returning an error.
- Added new test cases in `apps/login/src/lib/server/loginname.test.ts`
to verify the fix and ensure no regressions.
# Additional Changes
- Fixed inconsistency in translation files
---------
Co-authored-by: Livio Spring <[email protected]>
# Which Problems Are Solved
Fixes a problem where submit buttons where not correctly enabled onBlur
event
# How the Problems Are Solved
By changing the react-hook-form mode property to onChange, buttons are
enabled as intended
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->
# Which Problems Are Solved
Adding a generic SMTP server using the gRPC endpoints resulted in an
error. This was because the password field was requried.
# How the Problems Are Solved
Removed the requirement for a password from the mail config.
# Additional Context
closes#11084
# Which Problems Are Solved
Inconsistent naming of passkeys
# How the Problems Are Solved
translations are done using gemini
# Additional Changes
# Additional Context
- Closes#11298
---------
Co-authored-by: Gayathri Vijayan <[email protected]>
# Which Problems Are Solved
A customer reported that when the session in console expires and the
user is prompted to re-authenticate, users get a "mfa required" error
after the re-authentication, resp. after a redirect to the login.
Because of the login policy settings, they're not required to actively
re-authenticate, but are automatically signed-in again and then get the
error.
It was discovered, that the problem is due to the login v1 loading the
wrong login policy (from the default org or instance default) instead of
the user's organization. If there are differences in the allowed second
factors, e.g. if the user's organization allows OTP Email, but the
default policy doesn't allow that and neither policy enforces MFA, then
the login will not check for 2FA/MFA. The then created new OIDC session
/ tokens won't contain any MFA information, which results in the
described error.
# How the Problems Are Solved
When creating the auth request internally, we now check for a userID set
by the id_token_hint. In case it is set, the corresponding user will be
loaded already and the request will be aggregated with their information
incl. the organization id.
A `selectUser` function has been added for this and the existing
`SelectUser` used in the account selection page has been updated to use
the new function.
# Additional Changes
None
# Additional Context
- reported through support
- requires backport to v4.x and v3.x
Co-authored-by: Silvan <[email protected]>
# Which Problems Are Solved
A customer reported that multiple filters on the ListAdministrators
endpoint were returning a `List.Query.Invalid` error.
They were missing the implementation.
# How the Problems Are Solved
Implement `and`, `or`, `not` and `role` filters.
# Additional Changes
None
# Additional Context
- reported by customer
- requires backport to v4.x
# Which Problems Are Solved
Zitadel did not provide easy correlation between errors, logs, traces
and metrics. The configuration for those instrumentations was also not
consistent, with some supporting different exporters then others.
Implementation and parsing of config was also spaghettified over
multiple packages, with awkward parsing and inconsistent naming of
options.
# How the Problems Are Solved
All telemetry is now merged under the name "instrumentation". Why?
1. We thought it was a good idea in the past to call the milestone
exporter `Telemtry` in the runtime config. Calling this `TelemetryV2`
looks weird.
2. Not everything is a meter and not everything is sent (tele...).
3. It's also
[defined](https://opentelemetry.io/docs/concepts/instrumentation/) as
such by the OTEL documentation.
## New features
- Adds structured, context based logging with trace-ID awareness
- Static log fields are added to the context, such as service and
request path
- Static log fields are injected in each logline emitted by the
application
- Structured logs can also be send to an otel exporter
- Structured logs can be printed to StdErr in text and JSON format
- Error sinks make sure every error is logged at the correct level:
- Warnings for client side errors (HTTP 400 range, Invalid request etc)
- Error for server side errors (Internal server errors)
- Metrics can now also be send to a OTEL collector. (previously they
could only be scraped from `/debug/metrics` with prometheus)
## Exporters
This change adds all the exporters supported by OTEL upstream and some
google specific exporters for our cloud deployment.
- StdOut / StdErr: all instrumentations
- OTEL gRPC / HTTP: all instrumentations
- Google: all instrumentations except logging
- Prometheus (pull-based): only metrics
The exception is profiling, which only supports the google exporting due
to lack of support by OTEL upstream.
## Configuration and structure
- All instrumentation is moved into the new `backend/v3/instrumentation`
package. It reuses configuration types, so both code and runtime
configuration are easier to understand.
- The `internal/telemetry` packages are removed.
- Instrumentation is started with a single function and a proper
shutdown function is now provided.
- Legacy configuration is still parsed from the runtime config, as long
as the new configuration is disabled. This allows backporting this
feature to v4 without breaking existing configurations.
# Additional Changes
- Devcontainer: set `$PATH` variable so installed go binaries can be run
individually, without NX.
- NX: install GCI tool to fix imports
# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/8408
- Closes https://github.com/zitadel/zitadel/issues/6664
- Backport to v4
# Which Problems Are Solved
As part of the naming inconsistencies (#5888) we want to ensure action
v1 flow name are always correct and mapping to enum values line up:
#11309
# How the Problems Are Solved
Rename last "Customize SAML Response" occurrences to "Complement SAML
Response" where it's referring to the flow type. There are some titles
left with "customize SAML / OIDC response", which refer to the intent of
customizing the outcome and not directly to the flow type.
# Additional Changes
None
# Additional Context
- closes 11309
# Which Problems Are Solved
When building zitadel through `go build` or using an IDE debugging tool,
ldflags are not passed by dedault. In the past this was taken care of by
the `make compile` command, which got replaced by NX. The `nx
@zitadel/api:build` command does not set the ldflags either. Only the
`pack-platform` command does.
Because the ldflags aren't passed, the `date` and other variables remain
empty in the `cmd/build` package. During init of the package, if the
`version` is empty it defaults to the `date` variable. When the `date`
field was empty, the parsed `dateTime` would default to `time.Now()`,
but the `date` variable remained empty, resulting in a empty version.
A consistently empty version string prevents upgrades of projections on
dev systems, as the version from the last run is used.
# How the Problems Are Solved
If date failed to parse and `dateTime` is set to Now, use the formated
string of `dateTime` as `date`.
# Additional Context
- Blocks https://github.com/zitadel/zitadel/pull/11239
# Which Problems Are Solved
Fix failing compliance alert because of old depedencies.
# How the Problems Are Solved
Updated our npm dependencies
# Additional Changes
- Updated Docusaurus to React 19 to unify our react versions
- Fixed flaky e2e test
# Which Problems Are Solved
Similar to https://github.com/zitadel/zitadel/pull/11241, there are
additional unit tests where certificates expired.
# How the Problems Are Solved
The tests use dedicated combinations of SAML metadata, certificates and
responses and also already use the `TimeNow` function from the
`crewjam/saml` package to overwrite necessary time validations. This PR
now additionally sets the `Clock` variable in the same package, which is
used in XML validations like the signing.
# Additional Changes
None
# Additional Context
- relates to #11241
- requires backport to at least v4.x
# Which Problems Are Solved
As part of going to a relation storage model, we need to implement the
repository for handling sessions and their events.
# How the Problems Are Solved
- Adds a migration step to create the necessary tables and types in the
database.
- Adds the repository implementation for sessions.
- Implements a projection handler for session events to handle the
events written by the old command handlers.
- Updates the `Session` type and `SessionRepository` interface:
- added `CreatorID`
- Adjusted `Delete` method to return amount of affected columns
- Removed sub-repository clumns from the main interface
- Added `CreatorIDCondition`, `ExpirationCondition`, `ExistsFactor` and
`ExistsMetadata`
- Removed `SetUserAgent`
- Methods of `SessionFactor` and `SessionChallenge` have been made
public
- fixed enumer on `SessionFactorType`
- Adds a `JSON` type to the repository package to easy can JSON columns,
resp. jsonb object inside a property of a `JSONArray` object.
- Adds a `NoChange` interface, which can be implemented to signal that a
`Change` interface implementation is not writing any changes to the
statement builder, e.g. `CTEChange`
# Additional Changes
- Fixes the operators enums. `TextOperations` had wrong comments and
`NumberOperations` additionally also had from comparisons.
- Fixes downgrade of migration step 008.
# Additional Context
- closes https://github.com/zitadel/zitadel/issues/10212
# Which Problems Are Solved
A customer noted that one some of their environments actions were never
executed at all.
During the investigation it was discovered, that these systems did not
have any features set.
# How the Problems Are Solved
Fix the `scanAuthzInstance` function to handle queries without features
returned correctly.
# Additional Changes
None
# Additional Context
- reported through support
- requires backport to v4.x and v3.x
Closes#11184
# Which Problems Are Solved
- loginName: This information is already retrievable from the URL
parameters during the authentication flow, so logging it presented no
additional exposure.
- idpIntent: This was being logged to the server console (server-side
logs), so it was never exposed to the client/browser.
These changes simply clean up the server logs to prevent unnecessary
data noise.
# How the Problems Are Solved
- Removed idpIntent logging from
`apps/login/src/lib/server/idp-intent.ts`
- Removed loginName logging from
`apps/login/src/lib/server/password.ts`
---------
Co-authored-by: Livio Spring <[email protected]>
# Which Problems Are Solved
The application automatically appends the x-zitadel-public-host header
when a public host is configured. In some deployment scenarios where the
host is determined by default or via other means, sending this header
allows for improper routing or is simply redundant. The existing
CUSTOM_REQUEST_HEADERS configuration only supported adding or
overwriting headers, offering no way to remove headers that were set by
default logic.
# How the Problems Are Solved
Extended the `CUSTOM_REQUEST_HEADERS` handling in `src/lib/zitadel.ts`.
The logic now checks for empty header values. If a header is defined in
`CUSTOM_REQUEST_HEADERS` with an empty value (e.g.,
x-zitadel-public-host:), the interceptor will delete that header from
the request instead of setting it to an empty string. This allows users
to opt-out of default headers via configuration.
Closes#11191
# Which Problems Are Solved
This PR fixes the IDP linking for accounts with no authentication
method.
We strictly validate session ownership and generate a hash of the
sessionId + the user's fingerprintId cookie. This hash is passed to the
IDP as linkFingerprint.
This PR addtionally addresses TypeScript errors regarding unknown types
in catch blocks within the IDP intent processing logic. It ensures that
errors occurring during IDP linking are safely handled, and that
meaningful error messages are propagated to the client-side redirect
URLs.
# How the Problems Are Solved
- Safely handle unknown errors: Updated catch blocks in
`processIDPCallback` to check if the caught object is an instance of
Error before accessing error.message.
- Fix "IDP Taken" check: Implemented a safe check for the gRPC error
code 6 (Already Exists) by casting the error, resolving the Property
'code' does not exist on type 'unknown' build error.
- Error Propagation: The specific error message is now passed to the
linking-failed page params, allowing for better user feedback instead of
generic errors.
# Which Problems Are Solved
The config `DefaultInstance.LoginPolicy.IgnoreUnknownUsernames` is
ignored during application start.
# How the Problems Are Solved
Fix the typo in the field name `IgnoreUnknownUsernames` associated with
the config used while unmarshaling.
Previously: `IgnoreUnknownUsername`
# Additional Changes
N/A
# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/11007
# Which Problems Are Solved
Radio buttons in the User V2 creation form were unresponsive when
clicking directly on the radio button itself, only clicking on the label
text worked.
# How the Problems Are Solved
The app-auth-method-radio-theme mixin had a global input[type='radio']
selector that hid all radio inputs application-wide, breaking Angular
Material's mat-radio-button components. The selector is now scoped to
.auth-method-radio-button-wrapper so it only affects the intended
component.
# Additional Context
- Closes#11092
# Which Problems Are Solved
Some features moved from Beta to GA in V4, are still labeled as beta in
the docs and APIs refer to the now deprecated beta endpoints.
# How the Problems Are Solved
- remove the beta labels from webkeys, login v2, actions v2
- change example calls and API reference to v2 (instead of v2beta)
# Additional Changes
fixed typo in the web keys title (Oauth2 -> OAuth2)
# Additional Context
- Organization service v2(beta) is solved in
https://github.com/zitadel/zitadel/pull/11207
- relates to #10772
---------
Co-authored-by: Gayathri Vijayan <[email protected]>
Co-authored-by: Copilot <[email protected]>
# Which Problems Are Solved
The payload in actions V2 is currently sent as JSON to the target
endpoint. It might get exposed to intermediary infrastructure or logging
systems.
For these scenarios there needs to be an application-layer encryption,
where the provider of the endpoint can define an key to be used for the
encryption.
# How the Problems Are Solved
- Added an additional option to the target to specify the payload type:
`JSON` (current and default), `JWT`, `JWE` (api and console)
- added endpoints to upload and manage public keys (to be used for
encryption) for a target
- updated all action v2 executions (interceptors, oidc, saml, ...) to
provide the `GetActiveSigningWebKey` from queries
- implemented jwt and jwe in the exections incl. refactoring of code and
tests
- changes to the authn_keys table:
- added a `fingerprint` column
- dropped not null constraint on expiration
- moved the `GetSignerOnce` into its own package to prevent circular
dependencies
# Additional Changes
None
# Additional Context
closes#11061
---------
Co-authored-by: Marco A. <[email protected]>
Co-authored-by: conblem <[email protected]>
Co-authored-by: Silvan <[email protected]>
# Which Problems Are Solved
Some SAML integration tests used a hardcoded certificate, which expired
on the 25th December 2025.
# How the Problems Are Solved
Added helper functions to the integration package to create and store a
private key and certificate for SAML, which can be used in SAML SP/IDP
integration tests.
# Additional Changes
none
# Additional Context
- noted on #11196
- requires backport to at least v4.x
The current document for private key JWT is misleading, as it currently
looks like a mechanism to secure an API, and it's not, this section only
shows how to use private key JWT to call the introspect endpoint
RamonandGitHub
Federico CoppedeandGitHub
Livio SpringandGitHub
Mridang AgarwallaandGitHub
Matías RacedoandGitHub
