[Bug]: TOTP app registration fails if the requested user is not the same as the authenticated one

[ashep]

Preflight Checklist

• I could not find a solution in the documentation, the existing issues or discussions
• I have joined the ZITADEL chat

Environment

ZITADEL Cloud

Version

2.49.1

Database

PostgreSQL

Database Version

No response

Describe the problem caused by this bug

When I try to start the registration of a TOTP generator for a user using bearer token that is not belongs to the requested user, but to the IAM owner, I get the Request user not equal to authenticated user (AUTH-Bohd2) error.

To reproduce

Create a new user:

curl --request POST \
  --url http://zitadel:8081/v2beta/users/human \
  --header 'Authorization: Bearer IAM_OWNER_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
	"userId": "theUserID",
	"email": {
		"email": "theEmail@localhost",
		"isVerified": true
	},
	"profile": {
		"givenName": "theGivenName",
		"familyName": "theFamilyName"
	},
	"password": {
		"password": "theP@$$word1"
	}
}
'

Try to start the registration of a TOTP generator for a user:

curl --request POST \
  --url http://zitadel:8081/v2beta/users/theUserID/totp \
  --header 'Authorization: Bearer IAM_OWNER_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{}'

Response:

{
	"code": 7,
	"message": "Request user not equal to authenticated user (AUTH-Bohd2)",
	"details": [
		{
			"@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
			"id": "AUTH-Bohd2",
			"message": "Request user not equal to authenticated user"
		}
	]
}

Screenshots

No response

Expected behavior

To be able to start the registration of a TOTP generator for a user on behalf of the IAM owner.

Operating System

No response

Relevant Configuration

No response

Additional Context

No response

[ashep]

Hello @hifabienne! Is there any news about this? I probably misunderstand the concepts behind this API.

The question is: if I have to authenticate the request to this endpoint using the user's access token, why must the user ID be provided as well?

On the other hand, why isn't it allowed to perform the request on behalf of another user who has enough privileges, say, an IAM owner?

I really appreciate any help you can provide.

[hifabienne]

@stebenz @eliobischof can you help here?