|
| 1 | + |
| 2 | +## OIDC Single Sign On |
| 3 | + |
| 4 | +Listmonk supports single sign-on with OIDC (OpenID Connect). Any standards compliant OIDC provider can be configured in Settings -> Security -> OIDC |
| 5 | + |
| 6 | +!!! note "Automatic user creation" |
| 7 | + There is no support for automatic user creation via OIDC currently. The Super Admin must create users prior in Admin -> Users with the same e-mail address that is expected from the OIDC provider per user. |
| 8 | + |
| 9 | + |
| 10 | +# Tutorials |
| 11 | + |
| 12 | +Tutorials for configuring listmonk SSO with popular OIDC providers. |
| 13 | + |
| 14 | +## Keycloak |
| 15 | +Keycloak configuration for listmonk SSO integration. |
| 16 | + |
| 17 | +### 1. Create a new client in Keycloak |
| 18 | +In the Keycloak admin, use an existing realm, or create a new realm. Create a new client in `Clients → Create`. |
| 19 | + |
| 20 | +- **General Settings** |
| 21 | + - **Client type**: `OpenID Connect` |
| 22 | + - **Client ID**: `listmonk` (or any preferred name) |
| 23 | + - **Name**: Optional descriptive name (e.g., "listmonk SSO") |
| 24 | +- **Capability Config**: |
| 25 | + - **Client authentication**: On |
| 26 | + - **Authorization**: On |
| 27 | + - **Authentication Flow** |
| 28 | + - **Standard Flow**: On |
| 29 | + - **Direct Access grants**: On |
| 30 | +- **Login Settings**: |
| 31 | + - **Root URL**: Copy the **Redirect URL for oAuth provider** value from listmonk Admin -> Settings -> Security -> OIDC. It will look like `https://listmonk.yoursite.com/auth/oidc` |
| 32 | + - **Valid redirect URIs**: Same as the Root URL above |
| 33 | + - **Valid post logout redirect URIs**: * |
| 34 | + |
| 35 | +After the client creation steps above, go to the client's `Credentials` tab and copy the `Client Secret`. |
| 36 | + |
| 37 | +### 2. Configure Listmonk |
| 38 | +2. In Listmonk Admin -> Settings -> Security -> OIDC. |
| 39 | + - **Enable OIDC SSO**: Turn on |
| 40 | + - **Provider URL**: `https://keycloak.yoursite.com/auth/realms/{realm}` (replace `{realm}` with the chosen realm name) |
| 41 | + - **Provider name**: Set a name to show on the listmonk login form, eg: `Login with OrgName` |
| 42 | + - **Client ID**: Client ID set in Keycloak, eg: `listmonk` |
| 43 | + - **Client Secret**: Client Secret copied from Keycloak |
| 44 | + |
| 45 | + |
| 46 | + |
| 47 | +## Authentik |
| 48 | +Authentik configuration for listmonk SSO integration. |
| 49 | + |
| 50 | +### 1. Create a new OIDC provider in Authentik |
| 51 | +In the Authentik admin interface, create a new OIDC provider for listmonk. |
| 52 | + |
| 53 | +- **Provider Settings**: |
| 54 | + - **Name**: `listmonk` (or any preferred name) |
| 55 | + - **Signing Key**: `authentik Self-signed Certificate` |
| 56 | + - **Client Type**: `Confidential` |
| 57 | + - **Client ID**: `listmonk` (or any preferred name) |
| 58 | + - **Redirect URIs**: Copy the **Redirect URL for oAuth provider** value from listmonk Admin -> Settings -> Security -> OIDC. It will look like `https://listmonk.yoursite.com/auth/oidc` |
| 59 | + |
| 60 | +After creating the provider, copy the **Client Secret**. |
| 61 | + |
| 62 | +### 2. Create an application in Authentik |
| 63 | +Create a new application and connect it to the newly created provider. |
| 64 | + |
| 65 | +- **Application Settings**: |
| 66 | + - **Name**: `listmonk` (or any preferred name) |
| 67 | + - **Slug**: `listmonk` (or any preferred slug. Used in the redirect URL) |
| 68 | + - **Provider**: Select the OIDC provider created in the previous step |
| 69 | + |
| 70 | +### 3. Configure listmonk |
| 71 | +In listmonk Admin → Settings → Security → OIDC: |
| 72 | + |
| 73 | +- **Enable OIDC SSO**: Turn on |
| 74 | +- **Provider URL**: `https://authentik.yoursite.com/application/o/{slug}/` (replace `{slug}` with the application's slug) |
| 75 | +- **Provider Name**: Set a name to show on the login form (e.g., `Login with OrgName`) |
| 76 | +- **Client ID**: Client ID set in Authentik (e.g., `listmonk`) |
| 77 | +- **Client Secret**: Client Secret copied from Authentik |
0 commit comments