strapi-plugin-oidc

Single sign-on for Strapi 5! Log in to the administration screen using an OpenID Connect (OIDC) provider.

Optionally overwrites Strapi's default admin login page and endpoints.

Installation

yarn add @aartoni/strapi-plugin-oidc

or

npm i @aartoni/strapi-plugin-oidc

Configuration

With OIDC Discovery (recommended: the plugin auto-resolves endpoints from your provider):

export default ({ env }) => ({
  "oidc": {
    enabled: true,
    config: {
      issuer: "https://your-oidc-provider.com",
      clientId: "[Client ID from the provider]",
      clientSecret: "[Client secret from the provider]",
      redirectUri: "https://your-strapi/api/oidc/callback",
      scopes: "openid profile email groups",
    },
  },
});

Full options

Discoverable options are only required when discovery is false.

Key	Required	Default	Description
issuer	yes	–	Provider issuer URL (used for discovery and id_token validation)
discovery	no	true	Enable OIDC Discovery
clientId	yes	–	OIDC client ID
clientSecret	yes	–	OIDC client secret
redirectUri	yes	–	Callback URL after login
scopes	no	"openid profile email groups"	Space-separated OIDC scopes
authorizationEndpoint	discoverable	–	Provider authorization endpoint
tokenEndpoint	discoverable	–	Provider token endpoint
userInfoEndpoint	discoverable	–	Provider userinfo endpoint
jwksUri	discoverable	–	Provider JWKS URI
familyNameField	no	"family_name"	Userinfo claim for last name
givenNameField	no	"given_name"	Userinfo claim for first name
rememberMe	no	true	Store JWT in localStorage (true) or cookie (false)

Optional routing

To overwrite Strapi's default admin login page, you'll have to add an explicit Vite configuration and import the provided plugin.

import { oidcAuthPagePlugin } from '@aartoni/strapi-plugin-oidc/vite';
import { mergeConfig } from 'vite';

export default (config) =>
  mergeConfig(config, { plugins: [oidcAuthPagePlugin()] });

However, this is not enough to guarantee that your Strapi users won't try to login via API. To address that concern, you should load the provided middleware in your config/middlewares.ts.

// Default Strapi middleware stack, plus the native-auth blocker.
export default [
  "strapi::logger",
  "strapi::errors",
  "strapi::security",
  "strapi::cors",
  // ...
  "plugin::oidc.block-native-auth",
];

Add after the default stack, placing it earlier can block admin panel routes.

Role mapping

Admin roles can be mapped from OIDC claims using JMESPath expressions. You can edit the expression from this plugin's page in the admin sidebar, but no user can log in until one is set, so bootstrap an initial expression in src/index.ts (or equivalent) before first startup. See playground/src/index.ts for a working example.

OIDC provider

See the Docker compose file for an example of how to set-up Authelia as an OIDC provider.

Commercial providers might ship OIDC support, including:

• Google Identity Platform
• Amazon Cognito
• Microsoft Entra

Development

See CONTRIBUTING.md.