Auth SSO

2 min read

OIDC clients

sequenceDiagram
    participant U as Browser
    participant C as Native application
    participant A as auth.loca.zone OIDC provider
    U->>C: Choose Authelia sign-in
    C-->>U: Authorization request
    U->>A: Sign in and approve policy
    A-->>U: Authorization code
    U->>C: Registered callback with code
    C->>A: Exchange code using client authentication
    A-->>C: OIDC tokens and claims

Status

  • applied today:
    • Authelia has two OIDC client registrations
    • client IDs: lllm-gateway and coder
    • both use authorization-code flow and one_factor
  • applied portal and session changes:
    • did not add, remove, or alter either OIDC registration
  • source:
    • /home/loca/dev/services/authelia/config/configuration.yml

lllm-gateway

  • display name:
    • LiteLLM Gateway
  • client type:
    • public: false
    • token endpoint authentication: client_secret_basic
  • authorization:
    • policy: one_factor
    • consent mode: implicit
    • grant type: authorization_code
    • response type: code
  • callback allowlist:
    • https://lllm.loca.zone/sso/callback
  • scopes:
    • openid
    • profile
    • email
    • groups
  • response detail:
    • userinfo_signed_response_alg: none
  • secret handling:
    • configuration reads a digest from /config/secrets/oidc/client-secret.digest
    • the value is intentionally not reproduced here

coder

  • display name:
    • Coder
  • client type:
    • public: false
    • token endpoint authentication: client_secret_basic
  • authorization:
    • policy: one_factor
    • consent mode: implicit
    • grant type: authorization_code
    • response type: code
  • callback allowlist:
    • https://code.loca.zone/api/v2/users/oidc/callback
  • scopes:
    • openid
    • profile
    • email
    • groups
  • response detail:
    • userinfo_signed_response_alg: none
  • secret handling:
    • configuration reads a digest from /config/secrets/oidc/coder-client-secret.digest
    • the value is intentionally not reproduced here

Provider signing material

  • active JWK entry:
    • key ID: lllm
    • algorithm: RS256
    • use: sig
    • private key source: /config/secrets/oidc/jwks/private.pem
  • rule:
    • document paths and purpose only
    • never print, paste, or copy the private key or client-secret material into this wiki

Boundary with Nginx protection

  • OIDC registration:
    • lets the named application perform its own redirect and token exchange
    • requires the callback URL to match the registration
  • Nginx auth_request:
    • gates an HTTP location before the application sees the request
    • uses Protected apps
  • Coder example:
    • code.loca.zone is deliberately not listed as an Nginx one_factor host
    • Coder owns the browser OIDC flow
    • putting its CLI and agent traffic behind an interactive redirect gate would break those clients

Official reference