riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

fix(iam): use the built-in ZITADEL login page

Browse Source 
Sign-in failed with "Could not create session for user". The ZITADEL API
logged, on every session call:

  authz: verify access token -> invalid token
  token verifier repo: issuer does not match: Expected
    https://zitadel.riotpiao.com, got: login-client
  zitadel-login: [Password] Could not update session

The hosted Login UI authenticates as the machine user `login-client`. That
user did not exist in this instance, because the chart's setup job creates it
and setupJob is disabled after the first sync. Without the user the UI cannot
write a session, so no one can sign in, at ZITADEL or at Forgejo.

Disable the hosted Login UI so ZITADEL serves its built-in login, which needs
no machine user. Re-enable only after creating `login-client` and registering
the public key that matches zitadel-login-service-key.

Also register both callback spellings for the forgejo and paperless apps: the
callback path follows the login-source name, so a rename between authentik and
zitadel must not break sign-in.
This commit is contained in:
rock
2026-10-26 23:08:20 -07:00
parent 903a72a6fd
commit eaf9804374
4 changed files with 21 additions and 270 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/infra/iam/zitadel-values.yaml
+14 -1
View File
@@ -171,7 +171,20 @@ ingress:
controller: nginx
login:
enabled: true
# Built-in login page, not the hosted Login UI.
#
# The hosted UI authenticates to the ZITADEL API as the machine user
# `login-client`, using a JWT-profile assertion signed by the keypair in
# zitadel-login-service-key. That machine user is created by the chart's
# setup job, which this install runs only once (setupJob is deliberately
# disabled after the first sync). Without the user, every session write
# fails and the user sees "Could not create session for user", so no one
# can sign in here or at any relying party such as Forgejo.
#
# The built-in login serves the same flows from the ZITADEL server and
# needs no machine user. Turn this back on only after creating
# `login-client` and registering the matching public key.
enabled: false
# ksops owns this Secret (k8s/argocd/secrets/zitadel-login-service-key.enc.yaml,
# rendered by the sops-secrets Application). Pointing the chart at it stops the
# chart from auto-generating an RSA keypair every render, which changed