boris/keywarden
1
1 Fork 0
Code Issues 17 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

OIDC Integration: Supports Authentik officially, other solutions currently untested. Social login not implemented

Browse Source
This commit is contained in:
boris committed 2026-03-30 13:38:18 +01:00
1 parent dfea7e869b
commit 68bbb53976
28 files changed
+2365 -751
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.env.example
+38 -5
View File
@@ -19,13 +19,46 @@ KEYWARDEN_ADMIN_EMAIL=admin@example.com
KEYWARDEN_ADMIN_PASSWORD=password
# Auth mode: native | oidc | hybrid
# native: Uses JWT authentication based on Username / Password
# oidc: Disables in-build auth, exclusively uses OIDC configuration
# hybrid: Allows native auth, prefers oidc
KEYWARDEN_AUTH_MODE=native
# OIDC (optional)
# OIDC (optional) Currently supports Authentik officially and tested. Other solutions such as Keycloak may work.
# KEYWARDEN_OIDC_CLIENT_ID=
# KEYWARDEN_OIDC_CLIENT_SECRET=
# KEYWARDEN_OIDC_AUTHORIZATION_ENDPOINT=
# KEYWARDEN_OIDC_TOKEN_ENDPOINT=
# KEYWARDEN_OIDC_USER_ENDPOINT=
# KEYWARDEN_OIDC_JWKS_ENDPOINT=
# KEYWARDEN_OIDC_DISCOVERY_ENDPOINT= # Not required with Authentik
# KEYWARDEN_OIDC_AUTHORIZATION_ENDPOINT=https://auth.example.com/application/o/authorize/
# KEYWARDEN_OIDC_TOKEN_ENDPOINT=https://auth.example.com/application/o/token/
# KEYWARDEN_OIDC_USER_ENDPOINT=https://auth.example.com/application/o/userinfo/
# KEYWARDEN_OIDC_JWKS_ENDPOINT=https://auth.example.com/application/o/keywarden/jwks/
# KEYWARDEN_OIDC_ISSUER=
# KEYWARDEN_OIDC_PROVIDER_ID=corporate-sso # Not required with Authentik
# KEYWARDEN_OIDC_SCOPES=openid email profile groups
# KEYWARDEN_OIDC_REQUIRE_VERIFIED_EMAIL=true # Set to false if emails are not verified on provider
# KEYWARDEN_OIDC_EMAIL_CLAIM=email
# KEYWARDEN_OIDC_EMAIL_VERIFIED_CLAIM=email_verified
# KEYWARDEN_OIDC_USERNAME_CLAIM=preferred_username
# KEYWARDEN_OIDC_GROUPS_CLAIM=groups
# KEYWARDEN_OIDC_SYNC_ADMIN_FROM_GROUPS=false
# KEYWARDEN_OIDC_ADMIN_GROUPS=authentik Admins
# KEYWARDEN_OIDC_ADMIN_DEMOTE_ON_MISS=false
# Social login (optional)
# KEYWARDEN_SITE_ID=1
# KEYWARDEN_SOCIAL_REQUIRE_VERIFIED_EMAIL=true
# KEYWARDEN_SOCIAL_GOOGLE_ENABLED=false
# KEYWARDEN_SOCIAL_GOOGLE_CLIENT_ID=
# KEYWARDEN_SOCIAL_GOOGLE_CLIENT_SECRET=
# KEYWARDEN_SOCIAL_GITHUB_ENABLED=false
# KEYWARDEN_SOCIAL_GITHUB_CLIENT_ID=
# KEYWARDEN_SOCIAL_GITHUB_CLIENT_SECRET=
# KEYWARDEN_SOCIAL_APPLE_ENABLED=false
# KEYWARDEN_SOCIAL_APPLE_CLIENT_ID=
# KEYWARDEN_SOCIAL_APPLE_CLIENT_SECRET=
# Authentik Secrets
AUTHENTIK_PG_PASS=
AUTHENTIK_SECRET_KEY=