Re:Vaultwarden commit introduces SSO using OpenID Connect
by arjvik on Friday August 15, 2025 @02:27PM
(#44915862)
What's your (OSS?) OIDC server of choice?
Authelia? Authentik? Keycloak? (These are the three I see a lot about.) Something else?
Re:Vaultwarden commit introduces SSO using OpenID Connect
by thedanbob on Friday August 15, 2025 @04:15PM
(#44916837)
Adding another +1 to Pocket ID. I looked at a couple of the ones you mentioned but they looked too heavy and complex for what I wanted. Pocket ID does one thing and does it well.
Re:Vaultwarden commit introduces SSO using OpenID Connect
by samgnesin on Friday August 15, 2025 @03:37PM
(#44916560)
Pocket ID[1] is what I use, and I cannot recommend it enough. It's an incredible project.
Re:Vaultwarden commit introduces SSO using OpenID Connect
by udev4096 on Saturday August 16, 2025 @02:00AM
(#44920618)
Love pocket-id. Do you use oauth2-proxy with it? How did you set up oauth2-proxy to work with multiple apps?
Re:Vaultwarden commit introduces SSO using OpenID Connect
by carlhjerpe on Saturday August 16, 2025 @08:05AM
(#44922520)
I've dabbled in oauth2-proxy but I'm not running it currently. I recall my goto was launching one instance per remote i want to target.
Re:Vaultwarden commit introduces SSO using OpenID Connect
by udev4096 on Saturday August 16, 2025 @08:19AM
(#44922617)
Yeah that's hard to scale when you have lots of services. For now, I am running multiple instances of oauth2-proxy instances and assigning user groups in pocket-id. How do you deal with apps not having native OIDC support?
Re:Vaultwarden commit introduces SSO using OpenID Connect
by gh02t on Saturday August 16, 2025 @11:01AM
(#44924057)
I used to use oauth2-proxy with PocketID, but migrated to caddy-security for stuff that doesn't directly support OIDC as part of a general move to Caddy. It's nice not needing the sidecar container, though the docs for caddy-security are a bit confusing and I still find Caddy's whole approach to plugins a bit... odd. It does give you quite a lot of flexibility once you figure it out, and I think it was worthwhile after the initial learning period.
Re:Vaultwarden commit introduces SSO using OpenID Connect
by gh02t on Friday August 15, 2025 @03:24PM
(#44916458)
For self hosting, PocketID is about as easy to set up and maintain as it gets.
Re:Vaultwarden commit introduces SSO using OpenID Connect
by mmcnl on Friday August 15, 2025 @02:47PM
(#44916100)
I've used Authelia for a few years and it's great. It does exactly what I need/want. Not more, not less. It's also never failed me.
Re:Vaultwarden commit introduces SSO using OpenID Connect
by eloh on Friday August 15, 2025 @02:45PM
(#44916076)
Can recommend Kanidm
Re:Vaultwarden commit introduces SSO using OpenID Connect
by sp0ck on Friday August 15, 2025 @03:27PM
(#44916487)
Kanidm made some weird decision that ruled it out in one of big organisation I try to deploy it. Separate Radius password. For telco that’s half its use cases, and there is separate random password. Whole Network engineering department was like WTF ? You can’t have single password which is one of important reasons to have SSOA.
With SSO though, it's much simpler. I can just run an OIDC server and log into all my self-hosted services once, and I can use all of them. Vaultwarden is an exception to the rule though, as you can't really bootstrap that in the individual case.
Another use case I'm currently exploring is for sharing netflix/prime/disney+ passwords with roommates, partners and friends. They just sign in with their Google/Apple/whatever account and get access to the shared streaming provider passwords.