I've followed the relatively straight-forward docs for integrating Pangolin with Zitadel.
However, when trying to access a resource with a user provisioned for the Zitadel IdP, I get:
There was a problem connecting to Zitadel. Please contact your administrator.
User identifier not found in the ID token
I was unable to find the token in Chrome devtools otherwise I'd have looked at it in jwt.io and tried to see what I could find.
I was able to work around this by checking the "Include user's roles in the ID Token" in Zitadel -> Project -> Pangolin (App name) -> Token Settings.
Not sure if this is a bug on the Zitadel or the Pangolin side, but it seems a bit to have this field titled "roles" and then have a description of "Enables clients to retrieve profile, email, phone and address claims from ID token." Please investigate and let me know if you want me to open this bug over there.
Screenshot of the location of this checkbox in Zitadel:
Environment
For the OAuth app in Zitadel, I have the method set to Code with Basic/Authorization Code as the Auth Method/Grant Types
Just don't use the Zitadel that gets deployed with Pangolin in the quickstart.
Expected Behavior
I expect one of the following:
The docs to be updated if this is legitimate behaviour, OR
Zitadel to send preferred_username, OR
Pangolin to be able to pull the correct user name from the token that Zitadel sends when the checkbox mentioned above is not checked
Originally created by @baughmann on GitHub (Nov 12, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1851
### Describe the Bug
I've followed the relatively straight-forward [docs](https://docs.pangolin.net/manage/identity-providers/zitadel) for integrating Pangolin with Zitadel.
However, when trying to access a resource with a user provisioned for the Zitadel IdP, I get:
```
There was a problem connecting to Zitadel. Please contact your administrator.
User identifier not found in the ID token
```
I was unable to find the token in Chrome devtools otherwise I'd have looked at it in jwt.io and tried to see what I could find.
I was able to work around this by checking the "Include user's roles in the ID Token" in Zitadel -> Project -> Pangolin (App name) -> Token Settings.
Not sure if this is a bug on the Zitadel or the Pangolin side, but it seems a bit to have this field titled "roles" and then have a description of "Enables clients to retrieve profile, email, phone and address claims from ID token." Please investigate and let me know if you want me to open this bug over there.
Screenshot of the location of this checkbox in Zitadel:
<img width="981" height="712" alt="Image" src="https://github.com/user-attachments/assets/c87c682b-fc20-4b86-a9fd-35c0615b618f" />
### Environment
For the OAuth app in Zitadel, I have the method set to Code with Basic/Authorization Code as the Auth Method/Grant Types
- Zitadel Version: v4.6.5
- OS Type & Version: Ubuntu 24.04.3 LTS,
- Docker Engine: 29.0.0
- Pangolin Version: 1.12.2
- Gerbil Version: 1.2.2
- Traefik Version: v3.6
- Newt Version: Not relevant
- Olm Version: (if applicable)
### To Reproduce
Follow docs exactly: https://docs.pangolin.net/manage/identity-providers/zitadel
Just don't use the Zitadel that gets deployed with Pangolin in the quickstart.
### Expected Behavior
I expect one of the following:
- The docs to be updated if this is legitimate behaviour, OR
- Zitadel to send `preferred_username`, OR
- Pangolin to be able to pull the correct user name from the token that Zitadel sends when the checkbox mentioned above is not checked
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @baughmann on GitHub (Nov 12, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1851
Describe the Bug
I've followed the relatively straight-forward docs for integrating Pangolin with Zitadel.
However, when trying to access a resource with a user provisioned for the Zitadel IdP, I get:
I was unable to find the token in Chrome devtools otherwise I'd have looked at it in jwt.io and tried to see what I could find.
I was able to work around this by checking the "Include user's roles in the ID Token" in Zitadel -> Project -> Pangolin (App name) -> Token Settings.
Not sure if this is a bug on the Zitadel or the Pangolin side, but it seems a bit to have this field titled "roles" and then have a description of "Enables clients to retrieve profile, email, phone and address claims from ID token." Please investigate and let me know if you want me to open this bug over there.
Screenshot of the location of this checkbox in Zitadel:
Environment
For the OAuth app in Zitadel, I have the method set to Code with Basic/Authorization Code as the Auth Method/Grant Types
To Reproduce
Follow docs exactly: https://docs.pangolin.net/manage/identity-providers/zitadel
Just don't use the Zitadel that gets deployed with Pangolin in the quickstart.
Expected Behavior
I expect one of the following:
preferred_username, OR