Max Peintner 790244dd49 feat(login): synchronize instance roles for Zitadel identity provider (#12568) ...

# Which Problems Are Solved

- Logins through the new login via a Zitadel identity provider with
`instanceRolesInfo` configured (e.g. support access) create/update the
user,
but the instance member roles from the
`urn:zitadel:iam:org:project:roles`
claim are never assigned — that synchronization only exists in the login
v1
  flow. Support users therefore end up without any permissions.

# How the Problems Are Solved

- New `syncInstanceRolesFromIdpIntent` in the login, called after user
auto-creation and on existing-user logins. It mirrors the v1 filtering:
  roles are only honored for ZITADEL IdPs with `instanceRolesInfo`, when
granted in a configured organization (matched on ID and domain) and
using an
instance role key (`IAM_` prefix). Memberships are written merge-only
via
the v2 `InternalPermissionService` (existing roles are never removed),
and a
  failed sync logs a warning without blocking the login.

# Additional Changes

- Unit tests for the claim-to-role filtering.

# Additional Context

- Part of the "ZITADEL as an Identity Provider" epic: #5127
- Follow-up for PR #xxx (ZITADEL provider sign-in button in the new
login)

2026-08-12 09:25:12 +02:00

..

.changeset

chore: reproducible pipeline with dev containers (#10305)

2025-07-24 14:22:32 +02:00

zitadel-client

feat(login): synchronize instance roles for Zitadel identity provider (#12568)

2026-08-12 09:25:12 +02:00

zitadel-proto

chore: deps update (#12114)

2026-04-30 14:02:28 +00:00

AGENTS.md

chore(agents): add agents files (#11497)

2026-02-16 20:45:53 -08:00