Docs: Pangolin/Zitadel integration claims setup missing step #645

New Issue

MrUnknownDE · 2026-04-05T17:30:48+02:00

MrUnknownDE commented

2026-04-05 17:30:48 +02:00

Originally created by @baughmann on 11/12/2025

Describe the Bug

I've followed the relatively straight-forward docs for integrating Pangolin with Zitadel.

However, when trying to access a resource with a user provisioned for the Zitadel IdP, I get:

There was a problem connecting to Zitadel. Please contact your administrator.
User identifier not found in the ID token

I was unable to find the token in Chrome devtools otherwise I'd have looked at it in jwt.io and tried to see what I could find.

I was able to work around this by checking the "Include user's roles in the ID Token" in Zitadel -> Project -> Pangolin (App name) -> Token Settings.

Not sure if this is a bug on the Zitadel or the Pangolin side, but it seems a bit to have this field titled "roles" and then have a description of "Enables clients to retrieve profile, email, phone and address claims from ID token." Please investigate and let me know if you want me to open this bug over there.

Screenshot of the location of this checkbox in Zitadel:

Environment

For the OAuth app in Zitadel, I have the method set to Code with Basic/Authorization Code as the Auth Method/Grant Types

Zitadel Version: v4.6.5
OS Type & Version: Ubuntu 24.04.3 LTS,
Docker Engine: 29.0.0
Pangolin Version: 1.12.2
Gerbil Version: 1.2.2
Traefik Version: v3.6
Newt Version: Not relevant
Olm Version: (if applicable)

To Reproduce

Follow docs exactly: https://docs.pangolin.net/manage/identity-providers/zitadel

Just don't use the Zitadel that gets deployed with Pangolin in the quickstart.

Expected Behavior

I expect one of the following:

The docs to be updated if this is legitimate behaviour, OR
Zitadel to send preferred_username, OR
Pangolin to be able to pull the correct user name from the token that Zitadel sends when the checkbox mentioned above is not checked

*Originally created by @baughmann on 11/12/2025* ### Describe the Bug I've followed the relatively straight-forward [docs](https://docs.pangolin.net/manage/identity-providers/zitadel) for integrating Pangolin with Zitadel. However, when trying to access a resource with a user provisioned for the Zitadel IdP, I get: ``` There was a problem connecting to Zitadel. Please contact your administrator. User identifier not found in the ID token ``` I was unable to find the token in Chrome devtools otherwise I'd have looked at it in jwt.io and tried to see what I could find. I was able to work around this by checking the "Include user's roles in the ID Token" in Zitadel -> Project -> Pangolin (App name) -> Token Settings. Not sure if this is a bug on the Zitadel or the Pangolin side, but it seems a bit to have this field titled "roles" and then have a description of "Enables clients to retrieve profile, email, phone and address claims from ID token." Please investigate and let me know if you want me to open this bug over there. Screenshot of the location of this checkbox in Zitadel: <img width="981" height="712" alt="Image" src="https://github.com/user-attachments/assets/c87c682b-fc20-4b86-a9fd-35c0615b618f" /> ### Environment For the OAuth app in Zitadel, I have the method set to Code with Basic/Authorization Code as the Auth Method/Grant Types - Zitadel Version: v4.6.5 - OS Type & Version: Ubuntu 24.04.3 LTS, - Docker Engine: 29.0.0 - Pangolin Version: 1.12.2 - Gerbil Version: 1.2.2 - Traefik Version: v3.6 - Newt Version: Not relevant - Olm Version: (if applicable) ### To Reproduce Follow docs exactly: https://docs.pangolin.net/manage/identity-providers/zitadel Just don't use the Zitadel that gets deployed with Pangolin in the quickstart. ### Expected Behavior I expect one of the following: - The docs to be updated if this is legitimate behaviour, OR - Zitadel to send `preferred_username`, OR - Pangolin to be able to pull the correct user name from the token that Zitadel sends when the checkbox mentioned above is not checked

MrUnknownDE closed this issue

2026-04-05 17:30:48 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#645