forked from
lass.pds.lassul.us/superconfig
This repository has no description
modules.zitadel: grant declarative users by verified email only
find_user tried the configured name as login name first. With
UserLoginMustBeDomain off (Zitadel's default and ours), anyone who
registers picks any free username, including lass@lassul.us or the
address of someone who has not registered yet, and got the grant meant
for that address. Only a verified address cannot be claimed this way.
author
Hermes
committer
lassulus
date
(Oct 18, 2026, 9:57 AM CEST)
commit
46a5129d
46a5129d7dbd4c1226d4609a0450a2075cf0345b
parent
34a15640
34a156406d1d134ebd952a53f124cd208ec74d6e
+15
-17
+5
-4
modules/zitadel/default.nix
+5
-4
modules/zitadel/default.nix
···
138
138
type = lib.types.listOf lib.types.str;
139
139
default = [ ];
140
140
description = ''
141
-
Login names or verified email addresses of the users that
142
-
get a user grant on the project (access = "declarative").
143
-
Users who have not registered yet are skipped until the
144
-
next run.
141
+
Verified email addresses of the users that get a user
142
+
grant on the project (access = "declarative"). Not login
143
+
names: anyone can register a free one that looks like
144
+
someone's address. Users who have not registered or
145
+
verified their address yet are skipped until the next run.
145
146
'';
146
147
};
147
148
apps = lib.mkOption {
+10
-13
modules/zitadel/reconcile.py
+10
-13
modules/zitadel/reconcile.py
···
129
129
130
130
# projects, OIDC apps and user grants (default organization)
131
131
132
-
def find_user(name):
132
+
def find_user(email):
133
+
# Only verified addresses: anyone can register with any address and any
134
+
# free username, including one that looks like someone's address.
133
135
method = "TEXT_QUERY_METHOD_EQUALS_IGNORE_CASE"
134
-
users = search("/management/v1/users/_search", {"queries": [
135
-
{"loginNameQuery": {"loginName": name, "method": method}},
136
-
]})
137
-
if not users:
138
-
# only verified addresses: anyone can register with any address
139
-
users = [
140
-
u for u in search("/management/v1/users/_search", {"queries": [
141
-
{"emailQuery": {"emailAddress": name, "method": method}},
142
-
]})
143
-
if u.get("human", {}).get("email", {}).get("isEmailVerified")
144
-
]
136
+
users = [
137
+
u for u in search("/management/v1/users/_search", {"queries": [
138
+
{"emailQuery": {"emailAddress": email, "method": method}},
139
+
]})
140
+
if u.get("human", {}).get("email", {}).get("isEmailVerified")
141
+
]
145
142
if len(users) != 1:
146
-
print(f"user {name}: {len(users)} matches, skipped", file=sys.stderr)
143
+
print(f"user {email}: {len(users)} matches, skipped", file=sys.stderr)
147
144
return None
148
145
return users[0]["id"]
149
146