OIDC Environment Configuration

OIDC Environment Configuration

Environment mode is intended for Docker secret management and immutable infrastructure. It is read-only in System -> Authentication.

Example .env

OIDC_CONFIG_SOURCE=environment
OIDC_ENABLED=true
OIDC_ISSUER=https://idp.example.com/application/o/nutify
OIDC_CLIENT_ID=nutify
OIDC_CLIENT_SECRET=replace-with-provider-secret
OIDC_REDIRECT_URI=https://nutify.example.com/auth/oidc/callback
OIDC_SCOPES=openid profile email groups
OIDC_USERNAME_CLAIM=preferred_username
OIDC_GROUPS_CLAIM=groups
OIDC_ADMIN_GROUP=nutify-admins
OIDC_USER_GROUP=nutify-users
OIDC_ALLOW_ALL_USERS=false
OIDC_PROVIDER_NAME=Company SSO
OIDC_BUTTON_LABEL=Sign in with Company SSO
OIDC_AUTO_REDIRECT=false

Restart after changes:

docker compose up -d --force-recreate

Source Selection

• OIDC_CONFIG_SOURCE=environment: use only OIDC_* environment values.
• OIDC_CONFIG_SOURCE=database: use only the admin UI/database record.
• If omitted, legacy deployments with OIDC values automatically retain environment mode; otherwise Nutify defaults to database mode.

Required values are never merged across sources.

Validation

Environment OIDC fails closed unless all requirements pass:

• issuer and callback are absolute HTTPS URLs
• callback ends with /auth/oidc/callback
• Client ID and Client Secret are present
• username and groups claim names are non-empty
• administrator/user groups exist, or OIDC_ALLOW_ALL_USERS=true

When validation fails, public SSO is disabled and local login remains available. The UI displays a masked read-only error state and never returns the secret.

Development-only HTTP

OIDC_ALLOW_INSECURE_HTTP=true permits HTTP only for loopback issuer/callback URLs during local testing. Never use it for production or a LAN IdP.

Reverse Proxy

OIDC_REDIRECT_URI must use the exact external origin registered with the IdP. The proxy must forward the public scheme and host. Keep /auth/login?local=1 reachable for recovery.