Skip to main content

3.3 Login flow

Zitadel OIDC SSO · app JWT (HS256) · local admin fallback

UserFront-endLoginViewBackendZitadel IdPOpen https://ticket.fmt.com.tw/loginClick “Sign in with SSO”GET /api/auth/oidc/login (full-page redirect)issue HttpOnly cookie oidc_state (10 min)302 → Zitadel authorize URLuser signs in at Zitadel302 callback GET /api/auth/oidc/callback?code=…verify state cookie, exchange code, verify claimsmatch existing user by email (keeps Admin / Deploy_User role)not found → create, default General_Userissue app JWT (HS256)302 → PostLoginURL + "#token=<jwt>"consumeOidcRedirect() parses the fragment, stores in localStorageGET /api/auth/me (Bearer){username, displayName, role}redirect to the home page “Release form”

Figure 5 — Zitadel OIDC SSO login flow

Local admin account login: hidden on the login page by default; clicking the link "管理者帳密登入" (admin account login) expands the account / password form. This path is only the fallback for when the GKE environment cannot reach the internal AD (configured through LOCAL_ADMIN_USER / LOCAL_ADMIN_PASSWORD); a successful login is automatically granted the Admin role. Apart from this account, every other account / password login attempt is rejected (401 USE_SSO, message "請使用 SSO 登入" — please sign in with SSO).

A failed SSO login redirects back to the login page with the message "SSO 登入失敗，請重試或聯絡管理員。" (SSO login failed, please retry or contact an administrator).