Single sign-on#
Single sign-on through an identity provider that speaks OpenID Connect (OIDC) is an Enterprise feature. This page extends "Signing in through your identity provider" on Install in the Community guide.
Settings#
| Value | Meaning |
|---|---|
core.env.AUTH_MODE |
DEFAULT: passwords kept by Hyvop. OIDC: an identity provider that speaks OpenID Connect |
core.env.OIDC_ISSUER_URI |
The provider's issuer, whose discovery document core reads |
core.env.OIDC_CLIENT_ID |
The client registered for Hyvop there: a confidential one |
core.env.OIDC_CLIENT_SECRET |
Its secret, kept in the Secret hyvop-core-secrets |
core.env.OIDC_ROLE_CLAIM |
The claim of the ID token that says what a person is (default groups) |
core.env.OIDC_ADMIN_VALUES, core.env.OIDC_USER_VALUES |
The values of that claim that make an administrator and a user, comma-separated |
core.env.OIDC_DEFAULT_ROLE |
VIEWER (default), USER or ADMIN |
The chart refuses AUTH_MODE=OIDC without the issuer, the client id and the client secret. Register the redirect address
<the address of Hyvop>/api/auth/oidc/callback/oidc with the provider. Every value is described in
Configuration.
Keycloak#
Keycloak is off by default (keycloak.enabled: false). When you switch it on, the chart installs a development server
(start-dev, no database). Use it to try sign-in, and your own provider otherwise.
In a Community install#
A Community install that is configured for single sign-on starts all the same, and people sign in with their e-mail and password. The sign-in page says why.
Air-gapped installs#
An OIDC identity provider is an outbound call of core. In a closed install, see Air-gapped install for the call and its switch.
Not covered#
The Community guide documents OpenID Connect only. It does not document SAML or other single sign-on protocols, so this guide does not either.