FumeNodes/tabby-web
1
0
Fork 0
mirror of https://github.com/Eugeny/tabby-web.git synced 2026-08-16 22:36:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: add generic OIDC provider for self-hosted identity providers

Browse Source 
Adds support for any OpenID Connect compliant identity provider:
- Authentik
- Authelia
- Keycloak
- Okta
- Any other OIDC provider

Configuration via environment variables:
- SOCIAL_AUTH_OIDC_OIDC_ENDPOINT: Discovery endpoint
- SOCIAL_AUTH_OIDC_KEY: Client ID
- SOCIAL_AUTH_OIDC_SECRET: Client secret
- SOCIAL_AUTH_OIDC_NAME: Optional custom button text

Closes #140

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Brian Olson
2025-12-31 16:27:08 -05:00
parent 3aa321aff8
commit 33628af31f
4 changed files with 46 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
README.md
View File

@@ -52,9 +52,29 @@ Only providers with credentials configured will appear as login options. Set the
| Google | `SOCIAL_AUTH_GOOGLE_OAUTH2_KEY`, `SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET` |
| Microsoft | `SOCIAL_AUTH_MICROSOFT_GRAPH_KEY`, `SOCIAL_AUTH_MICROSOFT_GRAPH_SECRET` |
| Auth0 | `SOCIAL_AUTH_AUTH0_DOMAIN`, `SOCIAL_AUTH_AUTH0_KEY`, `SOCIAL_AUTH_AUTH0_SECRET` |
| Generic OIDC | `SOCIAL_AUTH_OIDC_OIDC_ENDPOINT`, `SOCIAL_AUTH_OIDC_KEY`, `SOCIAL_AUTH_OIDC_SECRET` |
For Auth0, set the callback URL to: `https://your-domain/api/1/auth/social/complete/auth0/`
### Generic OIDC Provider
The generic OIDC provider works with any OpenID Connect compliant identity provider, including:
- **Authentik** - Self-hosted identity provider
- **Authelia** - Self-hosted authentication server
- **Keycloak** - Open source identity management
- **Okta** - Enterprise identity platform
- And any other OIDC-compliant provider
Configuration:
- `SOCIAL_AUTH_OIDC_OIDC_ENDPOINT`: The OIDC discovery endpoint (e.g., `https://authentik.example.com/application/o/<app-slug>/`)
- `SOCIAL_AUTH_OIDC_KEY`: Client ID from your identity provider
- `SOCIAL_AUTH_OIDC_SECRET`: Client secret from your identity provider
- `SOCIAL_AUTH_OIDC_NAME` (optional): Custom button text (default: "SSO")
Set the callback URL to: `https://your-domain/api/1/auth/social/complete/oidc/`
**Note on MFA:** Multi-factor authentication is handled by your identity provider. Enable MFA in Authentik, Authelia, or your chosen provider to require 2FA for Tabby Web logins.
## Adding Tabby app versions
* `docker-compose run tabby /manage.sh add_version 1.0.163`