mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
5a2181bcec
# Which Problems Are Solved In many cases IAM was used where instance was meant. # How the Problems Are Solved - Rename wrong usage of IAM to instance all over the code base. - Add an agents.md which explains the terms used in Zitadel's architecture. # Additional Context - closes #11280 --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: muhlemmer <[email protected]> Co-authored-by: Copilot <[email protected]> Co-authored-by: Marco A. <[email protected]>
48 lines
2.5 KiB
Plaintext
48 lines
2.5 KiB
Plaintext
---
|
|
title: Connect your Self-Hosted Login UI to Zitadel
|
|
sidebar_label: Create a Login Client
|
|
---
|
|
|
|
To enable your self-hosted Login UI to connect to the Zitadel API, it needs a token for a user with the IAM_LOGIN_CLIENT role.
|
|
On new installations, the Zitadel setup job can be configured to automatically write a Personal Access Token (PAT) for the login client.
|
|
Check out [one of the deployment examples](https://zitadel.com/docs/self-hosting/deploy/overview) to learn how to do this.
|
|
|
|
However, if you want to replace the v1 login of an existing installation by a self-hosted v2 login, the setup job won't execute these steps.
|
|
In that case, you can create a new PAT for the login client manually.
|
|
|
|
## Create a Login Client User
|
|
|
|
In the following URLs, replace the base URL and the user ID according to your environment.
|
|
|
|
1. Create a new machine user, for example at http://localhost:8080/ui/console/users/create-machine
|
|
2. Create a PAT, for example at http://localhost:8080/ui/console/users/332169800719532035?new=true&id=pat
|
|
3. Save the PAT to a file, for example `/path/on/your/host/login-client.pat`
|
|
4. Make sure the user has the `Instance Login Client` role (internally called `IAM_LOGIN_CLIENT`), for example at http://localhost:8080/ui/console/instance/members
|
|
|
|
# Configure the Login UI
|
|
|
|
Make sure your Login UI has the environment variable `ZITADEL_SERVICE_USER_TOKEN` set with your PAT.
|
|
If you run the Login UI with Docker, you can also mount the file into the container and reference it by passing the environment variable `ZITADEL_SERVICE_USER_TOKEN_FILE`.
|
|
For example:
|
|
|
|
```bash
|
|
docker run -p 3000:3000 -v /path/on/your/host/login-client.pat:/path/in/container/login-client.pat:ro -e ZITADEL_SERVICE_USER_TOKEN_FILE=/path/in/container/login-client.pat ghcr.io/zitadel/zitadel-login:latest
|
|
```
|
|
|
|
# Enable the Login UI for all users
|
|
|
|
<Callout type="warn">
|
|
Before doing this, make sure you have a working PAT for an instance Owner user.
|
|
In case something goes wrong and you lock yourself out from the login screen, you can revert the changes.
|
|
Create a machine user PAT like you created the [login client PAT above](#create-login-client), but give the user the instance Owner role (internally called `IAM_OWNER`).
|
|
</Callout>
|
|
|
|
Enable the `Login V2` feature flag, for example at the bottom of http://localhost:8080/ui/console/instance?id=features.
|
|
Enter the base URI of your Login UI, for example `http://localhost:3000/ui/v2/login`.
|
|
|
|
# Test
|
|
|
|
That's it!
|
|
Click your users avatar in the top right corner of the management console and select `Log in With Another Account`.
|
|
You should see the new Login UI.
|