[GH-ISSUE #5791] After migration from legacy zitadel IdP to Dex, login via Zitadel reports "Errors.App.NotFound" #11083

New Issue

saavagebueno · 2026-08-05T01:28:25-04:00

saavagebueno commented

2026-08-05 01:28:25 -04:00

Originally created by @undes1red on GitHub (Apr 2, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5791

Describe the problem

I followed the migration tutorial here. The migration succeeded as https://<your-domain>/oauth2/.well-known/openid-configuration returns a valid json and my private networks are functioning. However, I can not log into the dashboard. The Continue with Email does not accept my credentials, and Continue with Zitadel shows Errors.App.NotFound. I affirm the AUTH_AUTHORITY is set to https://<your-domain>/oauth2 and I restarted the dashboard container, so I don't know why dashboard still redirects to oauth/v2.

To Reproduce

Steps to reproduce the behavior:

Migrate a legacy Zitadel deployment to Dex following this tutorial.
Open the dashboard.
Click Continue with Zitadel
See the error.

Expected behavior

I should see the zitadel login page and I can log in using my old credentials.

Are you using NetBird Cloud?

Self-hosted

NetBird version

0.67.2

Is any other VPN software installed?

No.

Debug output

docker-compose.yaml

services:
  # Caddy reverse proxy
  caddy:
    image: caddy
    restart: unless-stopped
    networks: [ netbird ]
    ports:
      - '<my_ip>:443'
      - '<my_ip>:443/udp'
      - '<my_ip>:80'
      - '<my_ip>:8080'
    volumes:
      - netbird_caddy_data:/data
      - ./Caddyfile:/etc/caddy/Caddyfile
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # UI dashboard
  dashboard:
    image: netbirdio/dashboard:latest
    restart: unless-stopped
    networks: [netbird]
    env_file:
      - ./dashboard.env
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Signal
  signal:
    image: netbirdio/signal:latest
    restart: unless-stopped
    networks: [netbird]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Relay
  relay:
    image: netbirdio/relay:latest
    restart: unless-stopped
    networks: [netbird]
    ports:
      - '3478:3478/udp'  # STUN UDP port (add more lines if using multiple ports)
    env_file:
      - ./relay.env
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Management
  management:
    image: netbirdio/management:latest
    restart: unless-stopped
    networks: [netbird]
    volumes:
      - netbird_management:/var/lib/netbird
      - ./management.json:/etc/netbird/management.json
    command: [
      "--port", "80",
      "--log-file", "console",
      "--log-level", "info",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=netbird.selfhosted",
      "--dns-domain=netbird.selfhosted",
      "--idp-sign-key-refresh-enabled",
    ]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Zitadel - identity provider
  zitadel:
    restart: 'always'
    networks: [netbird]
    image: 'ghcr.io/zitadel/zitadel:v2.64.1'
    command: 'start-from-init --masterkeyFromEnv --tlsMode external'
    env_file:
      - ./zitadel.env
    depends_on:
      zdb:
        condition: 'service_healthy'
    volumes:
      - ./machinekey:/machinekey
      - netbird_zitadel_certs:/zdb-certs:ro
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Postgres for Zitadel
  zdb:
    restart: 'always'
    networks: [netbird]
    image: 'postgres:16-alpine'
    env_file:
      - ./zdb.env
    volumes:
      - netbird_zdb_data:/var/lib/postgresql/data:rw
    healthcheck:
      test: ["CMD-SHELL", "pg_isready", "-d", "db_prod"]
      interval: 5s
      timeout: 60s
      retries: 10
      start_period: 5s
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

volumes:
  netbird_zdb_data:
    external: true
  netbird_management:
    external: true
  netbird_caddy_data:
    external: true
  netbird_zitadel_certs:
    external: true

networks:
  netbird:

dashboard.env:

# Endpoints
NETBIRD_MGMT_API_ENDPOINT=https://<my-domain>
NETBIRD_MGMT_GRPC_API_ENDPOINT=https://<my-domain>
# OIDC
USE_AUTH0=false
AUTH_AUDIENCE=netbird-dashboard
AUTH_CLIENT_ID=netbird-dashboard
AUTH_AUTHORITY=https://<my-domain>/oauth2
AUTH_SUPPORTED_SCOPES=openid profile email groups
AUTH_REDIRECT_URI=/nb-auth
AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
# SSL
NGINX_SSL_PORT=443
# Letsencrypt
LETSENCRYPT_DOMAIN=none

Caddyfile:

{
  debug
        servers :80,:443 {
    protocols h1 h2c h2 h3
  }
}

(security_headers) {
    header * {
        # enable HSTS
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#strict-transport-security-hsts
        # NOTE: Read carefully how this header works before using it.
        # If the HSTS header is misconfigured or if there is a problem with
        # the SSL/TLS certificate being used, legitimate users might be unable
        # to access the website. For example, if the HSTS header is set to a
        # very long duration and the SSL/TLS certificate expires or is revoked,
        # legitimate users might be unable to access the website until
        # the HSTS header duration has expired.
        # The recommended value for the max-age is 2 year (63072000 seconds).
        # But we are using 1 hour (3600 seconds) for testing purposes
        # and ensure that the website is working properly before setting
        # to two years.

        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"

        # disable clients from sniffing the media type
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options
        X-Content-Type-Options "nosniff"

        # clickjacking protection
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options
        X-Frame-Options "SAMEORIGIN"

        # xss protection
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection
        X-XSS-Protection "1; mode=block"

        # Remove -Server header, which is an information leak
        # Remove Caddy from Headers
        -Server

        # keep referrer data off of HTTP connections
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#referrer-policy
        Referrer-Policy strict-origin-when-cross-origin
    }
}

:80, tunnel.qkv.link:443 {
    # handle /.well-known/microsoft-identity-association.json {
    #     root * /hostfile
    #     file_server
    # }
    import security_headers
    # relay
    reverse_proxy /relay* relay:80
    # Signal
    reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000

    # Management
    reverse_proxy /api/* management:80
    reverse_proxy /management.ManagementService/* h2c://management:80
    reverse_proxy /oauth2/* management:80
    # Zitadel
    reverse_proxy /zitadel.admin.v1.AdminService/* h2c://zitadel:8080
    reverse_proxy /admin/v1/* h2c://zitadel:8080
    reverse_proxy /zitadel.auth.v1.AuthService/* h2c://zitadel:8080
    reverse_proxy /auth/v1/* h2c://zitadel:8080
    reverse_proxy /zitadel.management.v1.ManagementService/* h2c://zitadel:8080
    reverse_proxy /management/v1/* h2c://zitadel:8080
    reverse_proxy /zitadel.system.v1.SystemService/* h2c://zitadel:8080
    reverse_proxy /system/v1/* h2c://zitadel:8080
    reverse_proxy /assets/v1/* h2c://zitadel:8080
    reverse_proxy /ui/* h2c://zitadel:8080
    reverse_proxy /oidc/v1/* h2c://zitadel:8080
    reverse_proxy /saml/v2/* h2c://zitadel:8080
    reverse_proxy /oauth/v2/* h2c://zitadel:8080
    reverse_proxy /.well-known/openid-configuration h2c://zitadel:8080
    reverse_proxy /openapi/* h2c://zitadel:8080
    reverse_proxy /debug/* h2c://zitadel:8080
    reverse_proxy /device/* h2c://zitadel:8080
    reverse_proxy /device h2c://zitadel:8080
    # Dashboard
    reverse_proxy /* dashboard:80
}

Screenshots

Have you tried these troubleshooting steps?

Reviewed client troubleshooting (if applicable)
Checked for newer NetBird versions
Searched for similar issues on GitHub (including closed ones)
Restarted the NetBird client
Disabled other VPN software
Checked firewall settings

Originally created by @undes1red on GitHub (Apr 2, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5791 **Describe the problem** I followed the migration tutorial [here](https://docs.netbird.io/selfhosted/migration/external-to-embedded-idp). The migration succeeded as `https://<your-domain>/oauth2/.well-known/openid-configuration` returns a valid json and my private networks are functioning. However, I can not log into the dashboard. The `Continue with Email` does not accept my credentials, and `Continue with Zitadel` shows `Errors.App.NotFound`. I affirm the `AUTH_AUTHORITY` is set to `https://<your-domain>/oauth2` and I restarted the dashboard container, so I don't know why dashboard still redirects to `oauth/v2`. **To Reproduce** Steps to reproduce the behavior: 1. Migrate a legacy Zitadel deployment to Dex following this [tutorial]((https://docs.netbird.io/selfhosted/migration/external-to-embedded-idp)). 2. Open the dashboard. 3. Click `Continue with Zitadel` 4. See the error. **Expected behavior** I should see the zitadel login page and I can log in using my old credentials. **Are you using NetBird Cloud?** Self-hosted **NetBird version** 0.67.2 **Is any other VPN software installed?** No. **Debug output** docker-compose.yaml ``` services: # Caddy reverse proxy caddy: image: caddy restart: unless-stopped networks: [ netbird ] ports: - '<my_ip>:443' - '<my_ip>:443/udp' - '<my_ip>:80' - '<my_ip>:8080' volumes: - netbird_caddy_data:/data - ./Caddyfile:/etc/caddy/Caddyfile logging: driver: "json-file" options: max-size: "500m" max-file: "2" # UI dashboard dashboard: image: netbirdio/dashboard:latest restart: unless-stopped networks: [netbird] env_file: - ./dashboard.env logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Signal signal: image: netbirdio/signal:latest restart: unless-stopped networks: [netbird] logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Relay relay: image: netbirdio/relay:latest restart: unless-stopped networks: [netbird] ports: - '3478:3478/udp' # STUN UDP port (add more lines if using multiple ports) env_file: - ./relay.env logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Management management: image: netbirdio/management:latest restart: unless-stopped networks: [netbird] volumes: - netbird_management:/var/lib/netbird - ./management.json:/etc/netbird/management.json command: [ "--port", "80", "--log-file", "console", "--log-level", "info", "--disable-anonymous-metrics=false", "--single-account-mode-domain=netbird.selfhosted", "--dns-domain=netbird.selfhosted", "--idp-sign-key-refresh-enabled", ] logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Zitadel - identity provider zitadel: restart: 'always' networks: [netbird] image: 'ghcr.io/zitadel/zitadel:v2.64.1' command: 'start-from-init --masterkeyFromEnv --tlsMode external' env_file: - ./zitadel.env depends_on: zdb: condition: 'service_healthy' volumes: - ./machinekey:/machinekey - netbird_zitadel_certs:/zdb-certs:ro logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Postgres for Zitadel zdb: restart: 'always' networks: [netbird] image: 'postgres:16-alpine' env_file: - ./zdb.env volumes: - netbird_zdb_data:/var/lib/postgresql/data:rw healthcheck: test: ["CMD-SHELL", "pg_isready", "-d", "db_prod"] interval: 5s timeout: 60s retries: 10 start_period: 5s logging: driver: "json-file" options: max-size: "500m" max-file: "2" volumes: netbird_zdb_data: external: true netbird_management: external: true netbird_caddy_data: external: true netbird_zitadel_certs: external: true networks: netbird: ``` dashboard.env: ``` # Endpoints NETBIRD_MGMT_API_ENDPOINT=https://<my-domain> NETBIRD_MGMT_GRPC_API_ENDPOINT=https://<my-domain> # OIDC USE_AUTH0=false AUTH_AUDIENCE=netbird-dashboard AUTH_CLIENT_ID=netbird-dashboard AUTH_AUTHORITY=https://<my-domain>/oauth2 AUTH_SUPPORTED_SCOPES=openid profile email groups AUTH_REDIRECT_URI=/nb-auth AUTH_SILENT_REDIRECT_URI=/nb-silent-auth # SSL NGINX_SSL_PORT=443 # Letsencrypt LETSENCRYPT_DOMAIN=none ``` Caddyfile: ``` { debug servers :80,:443 { protocols h1 h2c h2 h3 } } (security_headers) { header * { # enable HSTS # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#strict-transport-security-hsts # NOTE: Read carefully how this header works before using it. # If the HSTS header is misconfigured or if there is a problem with # the SSL/TLS certificate being used, legitimate users might be unable # to access the website. For example, if the HSTS header is set to a # very long duration and the SSL/TLS certificate expires or is revoked, # legitimate users might be unable to access the website until # the HSTS header duration has expired. # The recommended value for the max-age is 2 year (63072000 seconds). # But we are using 1 hour (3600 seconds) for testing purposes # and ensure that the website is working properly before setting # to two years. Strict-Transport-Security "max-age=3600; includeSubDomains; preload" # disable clients from sniffing the media type # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options X-Content-Type-Options "nosniff" # clickjacking protection # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options X-Frame-Options "SAMEORIGIN" # xss protection # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection X-XSS-Protection "1; mode=block" # Remove -Server header, which is an information leak # Remove Caddy from Headers -Server # keep referrer data off of HTTP connections # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#referrer-policy Referrer-Policy strict-origin-when-cross-origin } } :80, tunnel.qkv.link:443 { # handle /.well-known/microsoft-identity-association.json { # root * /hostfile # file_server # } import security_headers # relay reverse_proxy /relay* relay:80 # Signal reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000 # Management reverse_proxy /api/* management:80 reverse_proxy /management.ManagementService/* h2c://management:80 reverse_proxy /oauth2/* management:80 # Zitadel reverse_proxy /zitadel.admin.v1.AdminService/* h2c://zitadel:8080 reverse_proxy /admin/v1/* h2c://zitadel:8080 reverse_proxy /zitadel.auth.v1.AuthService/* h2c://zitadel:8080 reverse_proxy /auth/v1/* h2c://zitadel:8080 reverse_proxy /zitadel.management.v1.ManagementService/* h2c://zitadel:8080 reverse_proxy /management/v1/* h2c://zitadel:8080 reverse_proxy /zitadel.system.v1.SystemService/* h2c://zitadel:8080 reverse_proxy /system/v1/* h2c://zitadel:8080 reverse_proxy /assets/v1/* h2c://zitadel:8080 reverse_proxy /ui/* h2c://zitadel:8080 reverse_proxy /oidc/v1/* h2c://zitadel:8080 reverse_proxy /saml/v2/* h2c://zitadel:8080 reverse_proxy /oauth/v2/* h2c://zitadel:8080 reverse_proxy /.well-known/openid-configuration h2c://zitadel:8080 reverse_proxy /openapi/* h2c://zitadel:8080 reverse_proxy /debug/* h2c://zitadel:8080 reverse_proxy /device/* h2c://zitadel:8080 reverse_proxy /device h2c://zitadel:8080 # Dashboard reverse_proxy /* dashboard:80 } ``` **Screenshots** <img width="3368" height="563" alt="Image" src="https://github.com/user-attachments/assets/d307b256-56b2-4515-994e-dbf5886cada0" /> **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [ ] Checked for newer NetBird versions - [ ] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [ ] Disabled other VPN software - [ ] Checked firewall settings

saavagebueno added the triage-needed label 2026-08-05 01:28:25 -04:00

saavagebueno closed this issue

2026-08-05 01:28:25 -04:00

saavagebueno commented

2026-08-05 01:28:25 -04:00

@pernetz commented on GitHub (Apr 3, 2026):

That's a good one! I am under preparation to also migrate my setup from legacy IdP to Dex. I will stop my efforts for now until this has been figured out.

What comes into my mind:
Are you sure your Zitadel instance is reachable via the web? Since the migration script requires the static connector config, what did you set there?
I was not sure which issuer domain to insert here: "config": { "issuer": "https://idp.example.com", ... }

In the legacy setup Zitadel had no dedicated domain name. It utilizes the forwarder https://<your-domain>/ui/console proxied by caddyfile entry reverse_proxy /ui/* h2c://zitadel:8080, I believe.

According to my understanding the connector config must be https://<your-domain> - that's it.

Maybe we can find out together. Keep me posted.

@pernetz commented on GitHub (Apr 3, 2026): That's a good one! I am under preparation to also migrate my setup from legacy IdP to Dex. I will stop my efforts for now until this has been figured out. What comes into my mind: Are you sure your Zitadel instance is reachable via the web? Since the migration script requires the static connector config, what did you set there? I was not sure which issuer domain to insert here: `"config": { "issuer": "https://idp.example.com", ... }` In the legacy setup Zitadel had no dedicated domain name. It utilizes the forwarder `https://<your-domain>/ui/console` proxied by caddyfile entry `reverse_proxy /ui/* h2c://zitadel:8080`, I believe. According to my understanding the connector config must be `https://<your-domain>` - that's it. Maybe we can find out together. Keep me posted.

saavagebueno commented

2026-08-05 01:28:25 -04:00

@undes1red commented on GitHub (Apr 3, 2026):

Hello @pernetz. I can access the zitadel instance at https://<your-domain>/ui/console. The issuer domain I believe is HttpConfig.AuthIssuer in your management.json.

@undes1red commented on GitHub (Apr 3, 2026): Hello @pernetz. I can access the zitadel instance at `https://<your-domain>/ui/console`. The issuer domain I believe is `HttpConfig.AuthIssuer` in your `management.json`.

saavagebueno commented

2026-08-05 01:28:25 -04:00

@pernetz commented on GitHub (Apr 3, 2026):

Hi @undes1red Awesome, that is definetifely the easier way to find out. However, it confirms my guess above https://<your-domain> is correct.

Check your Caddyfile, under # Zitadel it still proxies to reverse_proxy /oauth/v2/* h2c://zitadel:8080

@pernetz commented on GitHub (Apr 3, 2026): Hi @undes1red Awesome, that is definetifely the easier way to find out. However, it confirms my guess above `https://<your-domain>` is correct. Check your Caddyfile, under `# Zitadel` it still proxies to `reverse_proxy /oauth/v2/* h2c://zitadel:8080`

saavagebueno commented

2026-08-05 01:28:25 -04:00

@undes1red commented on GitHub (Apr 3, 2026):

reverse_proxy /oauth/v2/* h2c://zitadel:8080 comes with the default caddy config and the migration tutorial does not ask to change it. I also tried to remove it yesterday. Removing it caused clicking Continue with Zitadel jumped back to the netbird sign in page.

@undes1red commented on GitHub (Apr 3, 2026): `reverse_proxy /oauth/v2/* h2c://zitadel:8080` comes with the default caddy config and the migration tutorial does not ask to change it. I also tried to remove it yesterday. Removing it caused clicking `Continue with Zitadel` jumped back to the netbird sign in page.

saavagebueno commented

2026-08-05 01:28:25 -04:00

@pernetz commented on GitHub (Apr 3, 2026):

Allright got your point. I guess the migration guide is well tested. I just read through the steps beyond the dry-run execution. I must admit your configuration files apperantly look ok.

Did you try to docker compose up -d --force-recreate the management container?

@pernetz commented on GitHub (Apr 3, 2026): Allright got your point. I guess the migration guide is well tested. I just read through the steps beyond the dry-run execution. I must admit your configuration files apperantly look ok. Did you try to `docker compose up -d --force-recreate` the management container?

saavagebueno commented

2026-08-05 01:28:25 -04:00

@pernetz commented on GitHub (Apr 3, 2026):

Hey @undes1red Your dashboard.env is wrong. You are missing the USE_AUTH0=false line from previous configuration.
Insert and perform docker compose up dashboard (without -d) to check the log for errors during container startup.

Hope this works for you.

@pernetz commented on GitHub (Apr 3, 2026): Hey @undes1red Your `dashboard.env` is wrong. You are missing the `USE_AUTH0=false` line from previous configuration. Insert and perform `docker compose up dashboard` (without `-d`) to check the log for errors during container startup. Hope this works for you.

saavagebueno commented

2026-08-05 01:28:25 -04:00

@undes1red commented on GitHub (Apr 3, 2026):

@pernetz I tried docker compose up -d --force-recreate but has no effect. Also USE_AUTH0=false is in my dashboard.env. It is right below the # OIDC line.

@undes1red commented on GitHub (Apr 3, 2026): @pernetz I tried `docker compose up -d --force-recreate` but has no effect. Also `USE_AUTH0=false` is in my `dashboard.env`. It is right below the `# OIDC` line.

saavagebueno commented

2026-08-05 01:28:25 -04:00

@pernetz commented on GitHub (Apr 4, 2026):

@undes1red Aweee true that, I am sorry. Actually I am running out of ideas.

Have you checked the log for any errors while recreation? docker compose logs -f management
Else, are you sure the Zitadel credentials (ClientID and ClientSecret) are correct on both sides, zitadel web app and connector.json?

I finished the migration successful yesterday. The only issue I ran into was the missing USE_AUTH.

@pernetz commented on GitHub (Apr 4, 2026): @undes1red Aweee true that, I am sorry. Actually I am running out of ideas. Have you checked the log for any errors while recreation? `docker compose logs -f management` Else, are you sure the Zitadel credentials (ClientID and ClientSecret) are correct on both sides, `zitadel web app` and `connector.json`? I finished the migration successful yesterday. The only issue I ran into was the missing `USE_AUTH`.

saavagebueno commented

2026-08-05 01:28:25 -04:00

@undes1red commented on GitHub (Apr 4, 2026):

No worries. I checked the log of management and the only error is management-1 | 2026-04-04T01:24:33.400Z ERRO [id: accounts, err: failed to open connector: failed to create connector accounts: failed to get provider: 502 Bad Gateway: ] idp/dex/logrus_handler.go:83: server: Failed to open connector though I have no idea what this means.
I reread the tutorial and I think I might use the wrong client id and secret. Where do you get your client ID and secret? I got mine at IdpManagerConfig.ClientConfig.ClientID and IdpManagerConfig.ClientConfig.ClientSecret in the old management.json.

@undes1red commented on GitHub (Apr 4, 2026): No worries. I checked the log of `management` and the only error is `management-1 | 2026-04-04T01:24:33.400Z ERRO [id: accounts, err: failed to open connector: failed to create connector accounts: failed to get provider: 502 Bad Gateway: ] idp/dex/logrus_handler.go:83: server: Failed to open connector` though I have no idea what this means. I reread the tutorial and I think I might use the wrong client id and secret. Where do you get your client ID and secret? I got mine at `IdpManagerConfig.ClientConfig.ClientID` and `IdpManagerConfig.ClientConfig.ClientSecret` in the old `management.json`.

saavagebueno commented

2026-08-05 01:28:26 -04:00

@pernetz commented on GitHub (Apr 4, 2026):

This error message looks familiar to me. Mine pointed also to an issure with the connector, as far as I remember.

Your proceeding was wrong. You must register a new project and app inside your Zitadel console according to this guide: https://docs.netbird.io/selfhosted/identity-providers/zitadel
Therein you will get new keys for both, ClientID and ClientSecret. These keys are to be filled in the connector.json.

Good luck!

@pernetz commented on GitHub (Apr 4, 2026): This error message looks familiar to me. Mine pointed also to an issure with the connector, as far as I remember. Your proceeding was wrong. You must register a new project and app inside your Zitadel console according to this guide: [https://docs.netbird.io/selfhosted/identity-providers/zitadel](url) Therein you will get new keys for both, `ClientID` and `ClientSecret`. These keys are to be filled in the `connector.json`. Good luck!

saavagebueno commented

2026-08-05 01:28:26 -04:00

@undes1red commented on GitHub (Apr 4, 2026):

Hooary! The migration worked. Thank you @pernetz.

@undes1red commented on GitHub (Apr 4, 2026): Hooary! The migration worked. Thank you @pernetz.

Sign in to join this conversation.

Branches Tags

main

claude/agent-network-test-cases-p743vw

android/gui-integration

revert/component-types

feat-post_quantum_ml_kem

ice-stun-wg-demux

dependabot/npm_and_yarn/proxy/web/npm_and_yarn-b39864987c

agent-network-setup-poc

dependabot/go_modules/aws-sdk-8f849ebaed

dependabot/github_actions/actions-a940c7c866

dependabot/go_modules/otel-e34c790afd

dependabot/go_modules/testcontainers-de325c0dd6

dependabot/go_modules/wireguard-dbd6b95108

dependabot/go_modules/pion-5f703e1eca

dependabot/go_modules/gorm-2271c8195b

fix-login-needed-check

dependabot/go_modules/google.golang.org/grpc-1.82.1

fix/ui-gtk3-support

enterprise-traefik-and-migration-fixes

disambiguate_p2p_metrics

revert/component-types-hookup

embedded-vnc

feature/ios-ssh

docs/agent-network-docs-update

dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.106.3

dependabot/go_modules/github.com/pion/stun/v3-3.1.5

fix-ssh-authorized-users-multi-rule

peer-acl-multi-source

reverse-proxy-crowdsec-appsec

reverse-proxy-allow-match-or

client-local-metrics

lazy-conn-per-peer

lazy-conn-rosenpass

dependabot/go_modules/github.com/gopacket/gopacket-1.7.0

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.6

dependabot/go_modules/github.com/pires/go-proxyproto-0.15.0

dependabot/go_modules/github.com/jackc/pgx/v5-5.10.0

dependabot/go_modules/github.com/oapi-codegen/runtime-1.6.0

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.4

dependabot/go_modules/github.com/pkg/sftp-1.13.11

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.20.0

ssh-windows-privilege-check

fix/explicit-cors-handling

fix/remove-math-rand

test/gui-memory-leak-fix

fix/ui-status-dispatch

install-script-ui-dependencies

fix/grpc-get-network-map

fix/subscribe-status-coalesce

fix/tray-menu-item-leak

fix/windows-tray-race

feature/changeset

worktree-dns-route-qtype-fallthrough

mdm_integration

mlsmaycon-patch-2

feat/agent-network-ollama

proxy-tunnel-cache-ttl-env

coderabbitai/utg/1e5b0a5

grpc-acl

test/battery-drain

components-impl-drop-indexes-use-xids-no-resource-policy-map

fix/nmap-relevant-groups

e2e-guardrail-blocks-unselected-model

fix/lazyconn-cold-start-allowed-ips

vertex-guardrails-model-access-e2e

add-atomic-cache-ops

refactor/relay-foreign-cache

ci/trigger-release-tests

feature/kimi-3-agent-networks-dns-warmup

feature/dns-lazy-conn-warmup

daemon-ipc-acl

feature/ui-translation-key-parity-check

refactor/relay-foreign-cache-tests

fix/lazyconn-idle-keep-wg-peer

dmitri-propagate-auth-grant-types-on-combined

0.74.7-branch

diagnose-empty-vs-corrupt-state

windows-sleep-detector

fix/cli-up-wait-for-daemon

rp_key_persistency

feature/native-grpc

0.74.6-branch

0.74.6-branch-sync

0.74.5-branch-sync

0.74.4-branch

fix/remove-stale-peers-removal

fix/remove-stale-proxy-logic

fix/nsis-preserve-autostart-on-upgrade

refactor/peer-event-bus

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.3

dependabot/go_modules/github.com/pkg/sftp-1.13.10

components-impl-drop-indexes

fix-reset-aggregation-window-flake

dependabot/go_modules/github.com/pion/dtls/v3-3.1.5

0.74.x

fix/relay-states-lock

update-process-pkg

update-gopsutil-v4

fix/relay_states_lock

increase-sysinfo-timeout

dependabot/go_modules/github.com/Azure/go-ntlmssp-0.1.1

dependabot/go_modules/github.com/eko/gocache/store/redis/v4-4.2.6

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.3

fix/fail-to-create-upnp-port-mapping-on-opnsense-firewall

0.74.3-branch

fix/routeselector-atomic-exit-node

netmap_progressive_alignment

nmap/components-impl

dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

dependabot/go_modules/github.com/oapi-codegen/runtime-1.4.2

dependabot/go_modules/github.com/gopacket/gopacket-1.6.1

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.19.0

dependabot/go_modules/github.com/pires/go-proxyproto-0.12.0

fix/signal-watchdog-sync-stop

docs/agent-network

test/affected-logic

fix/revert-ice-filter

refactor/simplify-affected-peers

pascal-filter-policies-by-direction

claude/lock-contention-peer-connect-g8t6au

dmitri-filter-policies-by-direction

refactor/migrate-profiles-to-go

profile-bindings-ios

fix/skip-restart-unchanged-route

fix/mgmt-cache-async-resolve

refactor/wails-update-105

client_lifetime_serialization_refactor

fix/browser-ssh-2

fix/ipv6-and-netstack-accept-loop

fix/browser-ssh

profile-id-name-test

refactor/mgmt-bootstrap

feat/getting-started-unified-wizard

socket-grpc-permissions

fix/mysql-index-migration

windows-dns-firewall

tests/enable-race-on-tests

ui-refactor-gtk3

feature/affected-peers-grpc

profile-id

lazyconn-first-packet-fix-v2

claude/focused-gates-VMTgb

ui-tray-linux-leftclick

fix/ctx-enrichment

daemon-owner

feature/android-client-ssh

worktree-accept-ra-forwarding

nmap/combined-deploy

task/align_protobuff_toolset

feature/session-extend

add-json-yaml-flags

refactor/ephemeral-cleanup

claude/webtransport-relay-wasm-mUjY9

claude/vnc-udp-feasibility-6KB1U

fix/wgport-config

e2e-windows-dns-combined

fix/login-cmd-root-flags

feat/reseller-openapi-spec

github-issue-resolver

add-steamos-support

fix-darwin-uninstaller

flutter-test

ci/freebsd-pkg-bootstrap

cached-serial-check-on-sync

fix-mgmt-cache-bypass-overlay

revert-easyjson-5938

revert-ice-5820

revert-firewalld-5928

refactor/permissions-manager

revert-dns-5935-systemd-resolved

revert-dns-5935-5945

revert-dns-5945-mgmt-cache

feature/log-most-busy-peers

prototype/ui-wails

coderabbitai/utg/8ae8f20

feature/use-peer-fqdn-on-https

release/0.68.3

add-slack-channel

claude/rdp-token-passthrough-eNcqW

transparent-proxy

fix/macos-stale-route-eexist

crowdsec-selfhosted

fix/remove-otel-units

entire/checkpoints/v1

fix/getting-started

feat/static-connectors-combined-server

feature/use-local-keys-embedded

feature/fleetdm

set-env-only-if-not-fork

feature/expose-has-channel

fix/connection-status-race

fix/filter-cgnat-cni-ice-candidates

feature/check-cert-locker-before-acme

test/proxy-fixes

test/proxy-mtu

prototype/ui-tauri

test/proxy-speed

fix-reused-ports

feat/migrate-to-embedded-idp

feature/add-serial-to-proxy-merged

deploy/proxy-serial

test/connection

feature/disable-legacy-port

feature/flag-to-disable-legacy-port

test/perftest

fix/http-redirect

poc-token-command

dn-reverse-proxy

prototype/reverse-proxy-rename

prototype/reverse-proxy-logs-pagination

feature/client-metrics

prototype/reverse-proxy-clusters

debug-dns-route

fix/win-dns-batch

add-extra-route-logs

job-stream-notify-disconnection-eof

deploy/secrets-manager

trigger-proxy-update

bug/update-ios-client-code-build-tags

sync-client-netmap-serial

log/conn-disconn

nmap/compaction-deploy

ci-win-test

feature/disk-encryption-check

wasm-debug

swap-dns-prio

fix/dex-config

feature/migrate-auto-groups-to-table

nmap/compaction

dex-nocgo-stub

feature/exclude-terraform-from-rate-limiting

test-freebsd

retries-refactor

coderabbitai/docstrings/b7e98ac

feat/integrate-zitadel

bug/ios-hanging-reconection

zitadel-idp

feat/network-map-serial

refactor/get-account-no-users

feat/auto-upgrade

feature/report-high-pat-id

feature/temporary-access-for-resource

fix/nmap-fwrules

dont-restart-dns

prototype/ui

update-gomobile

go-dns-for-ice

wasm-ldflags

test-ldflags

wasmbuild-test

feature/networks-s2s

vk/compare-nmaps

dbg/bothmaps

reorder-dns-shutdown

fix/relay-reconnection-race

fix/nmap-exitnodes

vk/debug/nmap-both

move-licensed-code

feat/better-daemon-connection-lost-message

feat/auto-update-2

test/timings

refactor/getaccount-raw

tests/nmap-getaccount

refactor/nmap

refactor/nmap-limit-buffer

feature/detect-mac-wakeup

feature/extract-modules

quick-setings

feat/sync-limiter

feature/store-cache-impl

fix-install-version

feature/store-metrics

feature/metrics-on-store

feature/use-gorm-cache

loadtest-signal

unsymmetrical-squash

refactor/reducate-signaling

test/update-reduce

feature/store-cache

feature/remote-debug

cli-ws-proxy-backend-addr

feat/mgmt-map-serial

snyk-fix-d9d0081a4c7f9137bdb59d0d50a141a2

snyk-fix-7415cea5a11acd66753540ca2c598c63

job-yml-update

feature/android-allow-selecting-routes

fix/up-sequence

fix/dns-hash-update

snyk-fix-967adae9863f17f108ce8948d9117b8d

log/getaccount-by-peer

signal-suppressor

dns-exit-node

feature/auto-updates

feature/cache-srv-key

merged-fixes

fix/missed-offers-and-debug

debug-and-fixes

poc-wasm-clean-backend-s2s

test/remote-debug

debug-api

fix/remove-gpo-if-empty

fix/test-freebsd

fix/mysql-setup

fix/remove-logout-btn

handle-existing-domain-user

chore/unify-domain-validation

snyk-fix-c5fafc8a50ce1f29046e25a1fc346185

feat/profile-edit-btn

snyk-fix-a54966211e18d4cf67e5a2757cc006d1

log-short-id

feat/logout-ephemeral

log-checks

batch-wg-ops

nb-interface-default

feat/aws-integration

add/race-test

feature/relay-feature-versioning

fix/systemd-service-logs

poc/preprocessed-map

add-account-onboarding

bind-ipv6

fix/merge-main

logs/peerlogs-addpeer

feature/net-297-network-migration

feature/support-skip-auto-apply-exit-node-routes

set-cmd

set-command-with-cursor

feature/limit-update-channel

stop-using-locking-share

feature/poc-lazy-detection

feature/net-248-removal-of-sync-mutex-locks

test/multiple-peer-logging

preresolve

add-ns-punnycode-support

apply-routes-early

windows-search-domains

fix/connecting-route-filter

feature/management/rest-client/impersonate

debug-local-records

resource-fields-snake-case

test/grpc-rate-limit

traffic-correlation-policy

feature/rest-client-options

feat/events-metrics

feature/buf-cli

test/add-ratelimiter

test/remove-write-lock-on-add-peer

fix/add-peer-semaphore

feature/users-roles-endpoint

mlsmaycon-patch-1

debug-user-role

chore/primary-key-on-networks

feature/update-account-peers-buffer-startup

remove-ubuntu2004-runners

refactor/permissions-no-pat-allowed

ref/logrus-factory

use-conntrack-zone

deploy/permissions-account

feature/lazy-connection-idle

ref/improve-test-cov

restore-pr-3440

test/increase-grpc-timeouts

feat/buffer-account-peers-update

test/networkmapgeneration-changes

feature/base-manager

feature/flow-receiver

chore/benchmark-with-large-runner

refactor/handshake-initiator

client/ui-update-systray-icons

userspace-router

wgwatcher-test

output-if-key-already-exists

fix/relay-reconnection

feature/port-forwarding-client-codecleaning

detached2

test/callbacks-nil-iceconninfo

refactor/optimize-peer-expiration

enable-udp-port-for-docker-template

fix/relay-update

feature/apply-posture-netmap

fix/group-update-existing-resource

conntrack-stats

upgrade-okta-sdk

multi-price

test/conn-stat

set-min-parallel-tests-for-management

dns-interceptor

debug-dns

router-dns

add-static-system-info

debug-0.29.4

debug-0.33.0

account-refactoring

relay/2800_quic

route-get-account-refactoring

test/seed-random-routes

feature/get-account-refactoring

test/reconnect-race-condition

refactor/get-account-usage

feature/add-session-id-to-update-channel

improve-ipv4conn

fix/async-pion-event-handling

debug

add-offload

feature/validate-group-association-debug

fix/limit-conn-for-sqlite

test/engine-iface

test/transaction-for-jwt-sync

fix/engine-stop-in-foreground

feature/add-mysql-support

test-migration

refactor/header-size-values

relay/eliminate-gob

test/signal-dispatcher-with-relay

relay/debug

validate-icon

feature/ipv6-support

use-pre-expanded-peers-map

feature/use-signal-dispatcher

validate/peer-status

add-read-write-times

fix/sync-peer-race

feature/relay-status

netmap

evaluate/network-map-hash

fix/lower-dns-resolve-interval-on-fail

feature/relay

fix/go-mod-version

upgrade-nftables

synology-userspace-mode

fix/use-ip-for-default-routes-on-darwin

fix/proxy_close

enable-release-workflow-on-pr

deploy/peer-performance

feature/permanent-turn

feature/permanent-turn-proxy

deploy/posture-check-sqlite

feature/optimize_sqlite_save

debug-ios-behavior

fix/delete-route-only-after-adding

tshoot/windows-logger

remove-new-routing

refactor/eliminate-repo-dependency

add-arm-to-ci

refactor-demo-account-object

test/abc2

test/abc

send-ssh-rosenpass-config-meta

refactor-demo

ensure-schedule-never-runs-non-positive

feature/peer-validator-groupmgm

feature/peer-validator-fix

fix/include-active-dashboard-users

fix/handle-canceling-schedule

fix/geo-download

debug-google-workspace

yury/resolve-ip-to-location

feature/extend-sysinfo

sqlite-async-peer-status

yury/add-postgresql-store

fix/route

test-build

posture-checks-poc

debug-keycloak-idp

poc/netstack

for-pascal-tmp

peer-logout-management

manual-peer-logout

detached

chore/refactor-management

test/dns-bind

fix/enforce-acl-for-containers

yury/use-sync-map-in-updatechannel

fix/events-key-handling

filter-cache-on-load-account

fix/user-expiration

handle-user-context-cancellation

nb-client-k8s-statefulset

fake-addr

fix/iptables_in_docker

ebpf-debug

update-getting-started-flow-use-postgres

fix/peer_list_notification

feature/device-authentication-with-client-secret

feature/keep_alive

feat-groups-from-jwt

separate_proxy_from_wgconfig

fix/wg_conn

wg_conn_fix

wg_bind_parallel_processing

fix-rollback-get-acls

proxy_cfg_cleanup

performance-improvement-rego

update-lock-log-level

feat-client-side-acl

refactor/move_grpcserver_logic_to_account_manager

feature/event-storage

feature/update-idp-redeeming-invite

feature/api-peer-info

return-groupminimum-setupkey

feature/interface-bind

documentation_enhancement

fix-peer-registration

ssh

users_cache

pass-client-caller

client_caller_type

revert-283-feat-fix-windows-installer

periodic-peer-updates

ebpf

braginini/wasm

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DYNR/netbird#11083