Roles in ID token from Zitadel is removed
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 55/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- go
- Domain
- authentication, authorization
Research direction
Start by reproducing the issue with a Zitadel custom OIDC provider, using signInWithOAuth and auth.getSession to compare the ID token with the returned session. Trace how gotrue:v2.188.1 maps OIDC claims into session data; done means both Zitadel role keys remain available, with a regression test covering the behavior.
Written by the indexing model from the issue text.
Description
Bug report
- I confirm this is a bug with Supabase, not with my own application.
- I confirm I have searched the Docs, GitHub Discussions, and Discord.
Describe the bug
Zitadel sends roles in ID token using keys urn:zitadel:iam:org:project:<projectid>:roles and urn:zitadel:iam:org:project:roles. However, these keys are not present in session object returned from supabase.auth.getSession.
To Reproduce
- Create Zitadel project.
- Enable Asset Roles on Authentication in project settings.
- Create application(WEB/CODE) under project.
- Enable User roles inside ID Token in token settings.
- Add Zitadel as custom OIDC provider.
- Authenticate using
supabase.auth.signInWithOAuthand check session data usingsupabase.auth.getSession.
Expected behavior
Roles sent by Zitadel in ID token should be present in session data.
System information
- Self hosted Supabase
- supabase/gotrue:v2.188.1
- Dominant language
- Go
- Stars
- 2.6k
- Forks
- 764
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 39
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from supabase/auth
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Similar issues
-
optimization optimization:agents-md-curator
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
githubnext/gh-aw-cao#13143 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
blinklabs-io/bursa#904 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
yanet-platform/ipfw-go#129 ·
-
bug confmap/provider/googlesecretmanagerprovider needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
open-telemetry/opentelemetry-collector-contrib#51273 · 2 comments ·
-
bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100