Configuring user and login options (legacy Zitadel documentation)

Navigate to the Zitadel console at https://login.<YOUR_CONFIGURED_DOMAIN> and log in with your initial user account.

If you land on the info page of your admin account, navigate to https://login.<YOUR_CONFIGURED_DOMAIN>/ui/console, or click the logo in the top left corner. If this has no effect, you probably logged in with the wrong account.

Select the Pharia organisation:

In the Settings tab, select Identity Provider. Here you find a list of preconfigured external identity providers. Select the desired provider and follow the instructions.

Some identity providers do not provide email verification information, although the email address is already verified. In this case, check the box Email verified to prevent any additional email verification steps:

We recommend allowing accounts to be created automatically only. Enable this by selecting the following options:

Click Activate to activate the identity provider.

In the Settings tab, select Login Behavior and Security.

On the bottom of the page, check the box for External Login allowed.

Click Save.

Click the two arrows next to the organization name in the top left and select Show All Organizations:

Click the kebab menu icon next to the Pharia organisation line in the table and select Set as default organization:

Navigate to the Zitadel console at https://login.<YOUR_CONFIGURED_DOMAIN> and log in with your initial user account.

If you land on the info page of your admin account, navigate to https://login.<YOUR_CONFIGURED_DOMAIN>/ui/console, or click the logo in the top left corner. If this has no effect, you probably logged in with the wrong account.

Click Default settings on the upper right.

Navigate to the Email Providers section.

Add your preferred email provider by clicking its icon and following the instructions.

Select the Pharia organisation:

In the Settings tab, select Login Behavior and Security.

On the bottom of the page, check the boxes for User Registration allowed and Domain Discovery allowed:

Click Save.

Navigate to the settings for Verified domains.

If the email domain of your company does not already appear here, add it by clicking + New and following the instructions.

In the Actions tab, click + New to create a new action.

Give the action the same name as the function defined in the action; in our example: filterRegistration.

Copy the following code and paste it into the editor. Note that you need to replace the example domains with the domains you want to allow for sign-up, and you can add more domains if required:

 /**
** Only allow users with a given domain to register
 *
** Flow: Internal Authentication or External Authentication, Trigger: Pre creation
 *
** @param ctx
** @param api
 */
 function filterRegistration(ctx, api) {
 let validDomains = ["domain1.com", "domain2.com"];
 let isValid = false;
 for (const domain of validDomains){
 if (ctx.v1.user.human.email.endsWith("@" + domain)) {
 isValid = true;
 break;
 }
 }
 if (!isValid){
 throw "email needs to be from domain " + validDomains.join(", ");
 }
 }

Disable the box Allowed To Fail.
A warning is displayed to inform you that any coding errors (for example) may prevent users to register. However, we specifically want to prevent registration from users with an invalid domain, so you can close the warning.

Click Add.

Select the flow type Internal Authentication.

Click Add Trigger.

Select the trigger type Pre Creation.

Select the previously created action.

Click Save.