mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-11 11:16:55 +00:00
feat: add Custom OIDC provider and move SSO to Community tier (#626)
* feat: add Custom OIDC provider and move SSO to Community tier Add a generic Custom OIDC provider that works with any spec-compliant OIDC identity provider (Keycloak, Authentik, Authelia, Zitadel, KanIDM, Pocket ID, etc.) via standard discovery. Supports configurable claim mapping for User ID, Username, and Email fields to handle non-standard providers. Move all SSO functionality (LDAP and OIDC) from the Admiral tier to the Community tier so every user has access to identity provider integration. Backend: add oidc_custom to AuthProvider type, extend SSOService with claim mapping fields and env-var seeding, add oidc_custom to route validation, remove requireAdmiral guards from SSO config endpoints. Frontend: add Custom OIDC card with Display Name, Issuer URL, and claim mapping fields to SSOSection; add KeyRound icon on login page; remove AdmiralGate wrapper and lock icon from SSO settings nav. Tests: update tier guard expectations, add oidc_custom authorize/config/ provisioning tests and claim mapping coverage. All 992 tests pass. Docs: add Custom OIDC configuration reference, provider-specific setup examples, troubleshooting section, and updated screenshots. * fix: settings dialog close button overlap and combobox styling Reposition the close button in Settings Hub above the scroll area so it stays fixed when content scrolls. Increase dialog height to accommodate the growing number of setting sections. Fix combobox trigger styling to match Input component tokens (border-glass-border, bg-input) and eliminate the gap between trigger and dropdown list (top-full -mt-px). Apply the same fixes to multi-select-combobox for consistency. Add items-start to the Scopes/Default Role grid so the combobox aligns with the adjacent input field. Add showClose prop to DialogContent for consumers that need custom close button placement. Update SSO doc screenshots at 1920x900.
This commit is contained in:
Anso
@@ -3,9 +3,7 @@ title: SSO Setup Guide
|
||||
description: Step-by-step instructions for connecting Sencho to your identity provider.
|
||||
---
|
||||
|
||||
<Note>
|
||||
SSO requires a Sencho **Admiral** license. You can configure SSO via environment variables (shown below) or from the Settings UI after first boot.
|
||||
</Note>
|
||||
SSO can be configured via environment variables (shown below) or from the Settings UI after first boot.
|
||||
|
||||
## Google OIDC
|
||||
|
||||
@@ -35,7 +33,7 @@ Restart Sencho. A "Google" button will appear on the login page.
|
||||
|
||||
## GitHub OAuth
|
||||
|
||||
1. Go to **GitHub → Settings → Developer Settings → [OAuth Apps](https://github.com/settings/developers)**
|
||||
1. Go to **GitHub > Settings > Developer Settings > [OAuth Apps](https://github.com/settings/developers)**
|
||||
2. Click **New OAuth App**
|
||||
3. Set:
|
||||
- **Application name**: Sencho
|
||||
@@ -54,7 +52,7 @@ Restart Sencho. A "Google" button will appear on the login page.
|
||||
|
||||
## Okta OIDC
|
||||
|
||||
1. In the [Okta Admin Console](https://admin.okta.com), go to **Applications → Create App Integration**
|
||||
1. In the [Okta Admin Console](https://admin.okta.com), go to **Applications > Create App Integration**
|
||||
2. Select **OIDC - OpenID Connect** and **Web Application**
|
||||
3. Set the **Sign-in redirect URI** to: `https://sencho.example.com/api/auth/sso/oidc/oidc_okta/callback`
|
||||
4. Note your **Okta domain** (e.g., `https://dev-123456.okta.com`)
|
||||
@@ -70,6 +68,39 @@ Restart Sencho. A "Google" button will appear on the login page.
|
||||
- SSO_CALLBACK_URL=https://sencho.example.com
|
||||
```
|
||||
|
||||
## Custom OIDC (Keycloak, Authentik, Authelia, and others)
|
||||
|
||||
The Custom OIDC provider connects Sencho to any identity provider that supports OpenID Connect discovery. This includes Keycloak, Authentik, Authelia, Zitadel, KanIDM, Pocket ID, and any other spec-compliant provider.
|
||||
|
||||
1. In your identity provider, create a new **OIDC / OAuth2 client application**
|
||||
2. Set the **Redirect URI** to: `https://sencho.example.com/api/auth/sso/oidc/oidc_custom/callback`
|
||||
3. Note the **Issuer URL** (the base of the `/.well-known/openid-configuration` endpoint, without the well-known path)
|
||||
4. Copy the **Client ID** and **Client Secret**
|
||||
5. Add to your `docker-compose.yml`:
|
||||
|
||||
```yaml
|
||||
environment:
|
||||
- SSO_OIDC_CUSTOM_ENABLED=true
|
||||
- SSO_OIDC_CUSTOM_DISPLAY_NAME=Corporate SSO
|
||||
- SSO_OIDC_CUSTOM_ISSUER_URL=https://auth.example.com/realms/myrealm
|
||||
- SSO_OIDC_CUSTOM_CLIENT_ID=your-client-id
|
||||
- SSO_OIDC_CUSTOM_CLIENT_SECRET=your-client-secret
|
||||
- SSO_CALLBACK_URL=https://sencho.example.com
|
||||
```
|
||||
|
||||
If your provider uses non-standard claim names, add claim mapping:
|
||||
|
||||
```yaml
|
||||
environment:
|
||||
- SSO_OIDC_CUSTOM_ID_CLAIM=sub
|
||||
- SSO_OIDC_CUSTOM_USERNAME_CLAIM=preferred_username
|
||||
- SSO_OIDC_CUSTOM_EMAIL_CLAIM=email
|
||||
```
|
||||
|
||||
<Note>
|
||||
Most spec-compliant providers use the standard OIDC claim names (`sub`, `preferred_username`, `email`). You only need to configure claim mapping if your provider uses different names. See the [SSO feature page](/features/sso#provider-specific-setup-examples) for provider-specific notes.
|
||||
</Note>
|
||||
|
||||
## LDAP / Active Directory
|
||||
|
||||
1. Identify your LDAP server's URL and port (default: `389` for LDAP, `636` for LDAPS)
|
||||
@@ -116,7 +147,7 @@ By default, all SSO users are assigned the **Viewer** role. To grant Admin to sp
|
||||
This tells Sencho to check the `groups` claim in the OIDC ID token. If it contains `sencho-admins`, the user gets Admin. Roles are synced on every login, so removing a user from the admin group will demote them on their next sign-in.
|
||||
|
||||
<Note>
|
||||
Some providers (e.g., Azure AD, Okta) require custom scopes to include group claims in the ID token. You can configure additional scopes in the **Scopes** field in Settings > SSO, or via environment variable. The default is `openid email profile`.
|
||||
Some providers (e.g., Okta, Zitadel) require custom scopes to include group claims in the ID token. You can configure additional scopes in the **Scopes** field in Settings > SSO, or via environment variable. The default is `openid email profile`.
|
||||
</Note>
|
||||
|
||||
## Full docker-compose.yml example with SSO
|
||||
@@ -139,6 +170,12 @@ services:
|
||||
- SSO_OIDC_GOOGLE_ENABLED=true
|
||||
- SSO_OIDC_GOOGLE_CLIENT_ID=your-google-client-id
|
||||
- SSO_OIDC_GOOGLE_CLIENT_SECRET=your-google-secret
|
||||
# Custom OIDC (e.g., Keycloak)
|
||||
- SSO_OIDC_CUSTOM_ENABLED=true
|
||||
- SSO_OIDC_CUSTOM_DISPLAY_NAME=Keycloak
|
||||
- SSO_OIDC_CUSTOM_ISSUER_URL=https://keycloak.example.com/realms/myrealm
|
||||
- SSO_OIDC_CUSTOM_CLIENT_ID=your-keycloak-client-id
|
||||
- SSO_OIDC_CUSTOM_CLIENT_SECRET=your-keycloak-secret
|
||||
# LDAP
|
||||
- SSO_LDAP_ENABLED=true
|
||||
- SSO_LDAP_URL=ldap://ldap.example.com:389
|
||||
@@ -154,4 +191,4 @@ services:
|
||||
- SSO_CALLBACK_URL=https://sencho.example.com
|
||||
```
|
||||
|
||||
For the complete list of environment variables and their defaults, see [SSO & LDAP Authentication →](/features/sso#sso-environment-variables-reference).
|
||||
For the complete list of environment variables and their defaults, see [SSO & LDAP Authentication >](/features/sso#sso-environment-variables-reference).
|
||||
|
||||
Reference in New Issue
Block a user