Providers

Supported Providers

The plugin has been tested with the following identity providers. Click a provider name for a detailed setup guide.

OpenID Connect Providers

Provider	RBAC	Notes
Authelia	Yes	Requires disablePushedAuthorization: true
authentik	Yes
Keycloak	Yes	Supports both realm and client roles
Pocket ID	Yes
Kanidm	Yes
Google	No	Requires doNotValidateEndpoints: true; usernames are numeric

SAML Providers

Provider	RBAC	Notes
Keycloak	Yes	Full SAML 2.0 support

Adding a Provider Not Listed Here

Any OIDC or SAML 2.0 compliant provider should work. The general requirements are:

OpenID Connect:

• .well-known/openid-configuration discovery endpoint
• Authorization code flow
• Client ID and secret support
• Configurable redirect URI

SAML 2.0:

• Document signing enabled
• Client signature not required
• Configurable ACS URL
• Role attributes in assertions

If you successfully configure a provider not listed here, please contribute a guide by opening a pull request that updates providers.md.