OIDC / SSO Login
Traefik Manager supports OpenID Connect (OIDC), either alongside the built-in password or as the sole login method. When enabled, a "Sign in with ..." button appears on the login page. Disable built-in authentication to make OIDC mandatory - see Authentication modes.
How it works
- User clicks "Sign in with [Provider]" on the login page
- Traefik Manager fetches the provider's discovery document (
/.well-known/openid-configuration) and redirects to the authorization endpoint - User authenticates at the provider
- Provider redirects back to
/auth/oidc/callbackwith an authorization code - Traefik Manager exchanges the code for tokens, reads the claims (fetching userinfo when the id_token lacks them), checks access control, and establishes a session
OIDC login creates the same session as password login - the user lands on the dashboard with full access.
Setup
1. Register an application with your provider
You need a client ID and client secret. The redirect URI to register is:
https://your-traefik-manager.example.com/auth/oidc/callback2. Configure OIDC in Traefik Manager
Go to Settings → Authentication → OIDC / SSO and fill in:
| Field | Description |
|---|---|
| Provider URL | Base URL of your OIDC provider (without /.well-known/...) |
| Client ID | The client ID from your provider |
| Client Secret | The client secret (stored encrypted at rest) |
| Display Name | Label shown on the login button, e.g. Keycloak |
| Allowed Emails | Comma-separated list of emails that can log in. Empty = no email restriction |
| Allowed Groups | Comma-separated group names required. Empty = no group restriction |
| Groups Claim Key | Claim name that contains groups (default: groups) |
| Allow any authenticated account | Off by default. When both allow-lists are empty, logins are denied unless you enable this. Turn it on only if you intend to admit every account your provider authenticates |
| Automatic sign-in | Off by default. The login page silently tries OIDC first and signs you in with zero clicks when your provider already has a session |
Click Test next to the Provider URL to verify the discovery document is reachable, then click Save OIDC Config and toggle Enable.
Automatic sign-in
With Automatic sign-in enabled, opening the login page redirects straight to your provider with prompt=none - the OIDC-standard silent flow. If the provider already has a session for you, you land on the dashboard without clicking anything. If it does not (login_required), you get the normal login page, and no further silent attempts are made until your next browser session.
Notes:
- The login page stays reachable. Open
/login?auto=0to always get the form, even with a live provider session - useful for signing in with the local password instead. - Logging out does not log you back in. After logout the silent attempt is suppressed, so you see the login page as usual.
- Silent sign-in is a top-level redirect, not a hidden iframe or XHR, so it is unaffected by third-party cookie blocking.
Provider examples
Google OAuth2
- Go to Google Cloud Console → APIs & Services → Credentials
- Create an OAuth 2.0 Client ID (Web application)
- Add
https://your-traefik-manager.example.com/auth/oidc/callbackto Authorized redirect URIs
| Field | Value |
|---|---|
| Provider URL | https://accounts.google.com |
| Groups Claim Key | (leave default - Google does not expose groups) |
| Allowed Emails | Restrict to your domain or specific addresses |
Keycloak
| Field | Value |
|---|---|
| Provider URL | https://keycloak.example.com/realms/your-realm |
| Groups Claim Key | groups |
| Allowed Groups | Your Keycloak group name, e.g. traefik-admins |
In Keycloak: create a client with Standard Flow enabled, set the redirect URI, and add the groups mapper under Client Scopes so groups appear in the token.
Authentik
| Field | Value |
|---|---|
| Provider URL | https://authentik.example.com/application/o/your-app/ |
| Groups Claim Key | groups |
| Allowed Groups | Your Authentik group name |
In Authentik: create an OAuth2/OpenID Provider and a corresponding Application. Use Authorization Code flow. Either client type works - Traefik Manager sends a PKCE challenge, which public clients require.
Access control
Both filters are optional and independent:
- Allowed Emails - if set, the user's
emailclaim must be in this list, and the provider must report it as verified. Useful for allowing specific people from a shared provider (e.g. a Google Workspace domain). - Allowed Groups - if set, at least one of the user's groups must match. Useful for restricting by Keycloak or Authentik role.
If both are set, both conditions must pass.
If you leave both empty, access is denied by default - a successful login at your provider is not enough on its own. To intentionally allow every account your provider authenticates, enable Allow any authenticated account.
Mobile app
OIDC login applies to the web UI only. The mobile app authenticates via API key (X-Api-Key header) regardless of which login method is configured on the web.
If you use OIDC to log in to the web UI, generate an API key via Settings → Authentication → API Keys, then enter that key in the mobile app's Server settings. The process is identical to password-based login.
Rate limiting
/auth/oidc/login is rate-limited to 10 requests per minute per IP.
Security notes
- The OIDC client secret is encrypted at rest using Fernet symmetric encryption (the same key used for TOTP secrets).
- The authorization request uses PKCE (
S256). - The
stateparameter is validated on callback to prevent CSRF attacks. - A
nonceis sent in the authorization request and checked against the id_token on return. - Token exchange and userinfo fetch happen server-side - no tokens are exposed to the browser.