Configure OpenID Connect (OIDC)¶

Replace the single-user fallback with real single sign-on against your identity provider (IdP).

Prerequisites¶

• An OIDC provider (Keycloak, Entra ID, Auth0, and so on)
• Your Stegflow public URL, for example https://stegflow.example.com

Step 1: Register a client in your IdP¶

Create a confidential client and note its client ID and secret. Configure:

• Redirect URI: https://<your-host>/signin-oidc
• Post-logout redirect URI: https://<your-host>/signout-callback-oidc
• Scopes: openid, profile, email

Step 2: Set the OIDC settings¶

STEGFLOW_OIDC__AUTHORITY=https://id.example.com/realms/stegflow
STEGFLOW_OIDC__CLIENTID=stegflow
STEGFLOW_OIDC__CLIENTSECRET=...
STEGFLOW_ENGINE__ADMINEMAILS__0=you@example.com

Setting an authority disables single-user mode. Setting an administrator email makes you global admin; without one, nobody is.

Variations¶

• Authenticate with a certificate instead of a secret:
  1. Leave STEGFLOW_OIDC__CLIENTSECRET empty.
  2. Set STEGFLOW_OIDC__CERTIFICATE__PATH to a PFX or PEM file.
  3. Set STEGFLOW_OIDC__CERTIFICATE__PASSWORD for a protected PFX.
• Different claim names: if your IdP names the name, email, timezone or avatar claims differently, remap them with the STEGFLOW_OIDC__CLAIMS__* variables.

Result¶

Opening the console now redirects to your IdP to sign in. After login you come back authenticated, and your email identifies your account.

See the configuration reference for the full list of OIDC options, including claim mapping, the certificate and the HTTPS metadata setting.