Although in the subscription version, SSO is not available unless you purchase the “Contact Us” version. sso.tax would like a word.
Lem453@lemmy.ca 11 months ago
Thank you for including oAuth options for sign on. Makes a big difference being able to use the same account for all the things like freshRSS, seafile, immich etc.
subtext@lemmy.world 11 months ago
Lem453@lemmy.ca 11 months ago
Free for self hosted which is probably what matters to most here
subtext@lemmy.world 11 months ago
Definitely a fair point, always good to see that in a project
Kir@feddit.it 11 months ago
I’m intrigued. How does it work? Do you have a link or an article to point me to?
Lem453@lemmy.ca 11 months ago
The general principle is called single sign on (sso).
The idea is that instead of each all keeping track of users itself, there is another app (sometimes called an identity provider) that does this. Then when you try to log into an app, it takes to the to login of your identity provider instead. When the IP says you are the correct user, it sends a token to the app saying to let you access your account.
The huge benefits are if you are already logged into the IP on a browser for example, the other apps will login automatically without having to put in your password again.
Also for me the biggest benefit is not having to manage passwords for a large number of apps so family that uses my server have 1 account which gives them access to jellyfin, seafile, immich, freshrss etc. If they change that password it changes it for everything. You can enforce minimum password requirements. You can also add 2FA to any all now immediately.
I use Authentik as my identity provider: goauthentik.io/https://goauthentik.io/
There’s good guides to settings it up with traefik so that you get let encrypt certificates and can use traefik for proxy authentication on web based apps like sonarr. There are many different authentication methods an app can choose to use and Authentik essentially supports everything.