github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-06 12:55:03 -05:00
Code Issues 537 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #1851] Docs: Pangolin/Zitadel integration claims setup missing step #6822

New Issue
Closed
opened 2026-04-25 15:46:31 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-25 15:46:31 -05:00
Owner
Copy Link

Originally created by @baughmann on GitHub (Nov 12, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1851

Describe the Bug

I've followed the relatively straight-forward docs for integrating Pangolin with Zitadel.

However, when trying to access a resource with a user provisioned for the Zitadel IdP, I get:

There was a problem connecting to Zitadel. Please contact your administrator.
User identifier not found in the ID token

I was unable to find the token in Chrome devtools otherwise I'd have looked at it in jwt.io and tried to see what I could find.

I was able to work around this by checking the "Include user's roles in the ID Token" in Zitadel -> Project -> Pangolin (App name) -> Token Settings.

Not sure if this is a bug on the Zitadel or the Pangolin side, but it seems a bit to have this field titled "roles" and then have a description of "Enables clients to retrieve profile, email, phone and address claims from ID token." Please investigate and let me know if you want me to open this bug over there.

Screenshot of the location of this checkbox in Zitadel:

Image

Environment

For the OAuth app in Zitadel, I have the method set to Code with Basic/Authorization Code as the Auth Method/Grant Types

  • Zitadel Version: v4.6.5
  • OS Type & Version: Ubuntu 24.04.3 LTS,
  • Docker Engine: 29.0.0
  • Pangolin Version: 1.12.2
  • Gerbil Version: 1.2.2
  • Traefik Version: v3.6
  • Newt Version: Not relevant
  • Olm Version: (if applicable)

To Reproduce

Follow docs exactly: https://docs.pangolin.net/manage/identity-providers/zitadel

Just don't use the Zitadel that gets deployed with Pangolin in the quickstart.

Expected Behavior

I expect one of the following:

  • The docs to be updated if this is legitimate behaviour, OR
  • Zitadel to send preferred_username, OR
  • Pangolin to be able to pull the correct user name from the token that Zitadel sends when the checkbox mentioned above is not checked
Originally created by @baughmann on GitHub (Nov 12, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/1851 ### Describe the Bug I've followed the relatively straight-forward [docs](https://docs.pangolin.net/manage/identity-providers/zitadel) for integrating Pangolin with Zitadel. However, when trying to access a resource with a user provisioned for the Zitadel IdP, I get: ``` There was a problem connecting to Zitadel. Please contact your administrator. User identifier not found in the ID token ``` I was unable to find the token in Chrome devtools otherwise I'd have looked at it in jwt.io and tried to see what I could find. I was able to work around this by checking the "Include user's roles in the ID Token" in Zitadel -> Project -> Pangolin (App name) -> Token Settings. Not sure if this is a bug on the Zitadel or the Pangolin side, but it seems a bit to have this field titled "roles" and then have a description of "Enables clients to retrieve profile, email, phone and address claims from ID token." Please investigate and let me know if you want me to open this bug over there. Screenshot of the location of this checkbox in Zitadel: <img width="981" height="712" alt="Image" src="https://github.com/user-attachments/assets/c87c682b-fc20-4b86-a9fd-35c0615b618f" /> ### Environment For the OAuth app in Zitadel, I have the method set to Code with Basic/Authorization Code as the Auth Method/Grant Types - Zitadel Version: v4.6.5 - OS Type & Version: Ubuntu 24.04.3 LTS, - Docker Engine: 29.0.0 - Pangolin Version: 1.12.2 - Gerbil Version: 1.2.2 - Traefik Version: v3.6 - Newt Version: Not relevant - Olm Version: (if applicable) ### To Reproduce Follow docs exactly: https://docs.pangolin.net/manage/identity-providers/zitadel Just don't use the Zitadel that gets deployed with Pangolin in the quickstart. ### Expected Behavior I expect one of the following: - The docs to be updated if this is legitimate behaviour, OR - Zitadel to send `preferred_username`, OR - Pangolin to be able to pull the correct user name from the token that Zitadel sends when the checkbox mentioned above is not checked
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#6822
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?