Skip to main content
Identity plugin · listing tai42/accounts-oidc

​
Install

​
Permissions

​
Provides

​
accounts-oidc

Identity — OIDC/OAuth2 login accounts provider — session-based login via an external identity provider with SSO code hand-back.

​
login

Router — The public /api/login/* login-flow routes. Adds “sign in with…” buttons to the login screen, backed by your own OIDC providers. It runs the authorization-code flow with PKCE, then hands the browser a short-lived code the Studio exchanges for a session. The account model stays central; see Accounts.

​
accounts-oidc

The identity provider. Mount it with its router and add it to the auth-provider list:
manifest.yml
Each provider row takes a name (lowercase slug, unique) and the client credentials, plus optionally preset, issuer, scopes, claim, and a display label and icon. The presets are google, auth0, okta, keycloak, azure, and github; google and github carry fixed endpoints, and the others need a per-tenant issuer. A row with no preset at all is a raw OIDC provider and needs its own issuer.

​
Register the redirect URI

Every provider row uses one callback URL, built from the public base URL and the row’s name:
Register that exact URL in the provider’s console. The authorize request always sends PKCE with S256, and OIDC presets additionally send a nonce.
Signing in does not create an account. A successful sign-in resolves to the user id oidc:{provider}:{subject}, and until a policy exists for that id every protected route denies the request. Provision the policy first, then invite the person to sign in.

​
login

The public /api/login/* login-flow routes that drive the sign-in buttons and the code hand-back. Both this provider and a password provider mint sessions with the same token prefix and are told apart by a store lookup, so the order of ACCESS_CONTROL_AUTH_PROVIDERS matters: an outage in an earlier member fails closed for the members after it.

​
See also