[Idea] Configure OIDC authentication via environment variables

[xd003]

What problem does this solve?

Traefik Manager currently supports OIDC, but it must first be configured through the UI after logging in with local authentication. For automated/self-hosted deployments, this means the initial deployment is not fully declarative, a local password still needs to be created and stored, followed by manual OIDC setup through the UI.

Proposed solution

Allow OIDC to be configured directly through environment variables, including things like the issuer/discovery URL, client ID/secret, scopes, redirect URL.

This would make OIDC usable right from the first startup, without having to create/store a local password and then configure OIDC manually through the UI.

A few benefits:

• Fully declarative Docker Compose deployments with pre defined authentication.
• OIDC works immediately after deployment.
• Local authentication can be disabled from the start.
• Easier to move/redeploy an instance without repeating the OIDC setup.
• Works much better with IaC and automated deployments.
• This is also a fairly common pattern in other self-hosted projects that support OIDC.

The existing UI configuration could remain as-is, with environment variables taking precedence when provided.

Which area does this relate to?

Authentication / Security

[chr0nzz]

for manged deployments use the manager.yml

[xd003]

manager.yml

Thanks for the quick reply. Does the example here contain all of the available manager.yml options?

https://traefik-manager.xyzlab.dev/manager-yml#example

I noticed manager.yml also includes settings that are already supported through environment variables, such as:

acme_json_path: ""
access_log_path: ""
static_config_path: ""

It would be nice to have OIDC defined via env vars, so manager.yml isn't required just for authentication. OIDC configuration via environment variables also fits naturally with Docker based deployments.

[chr0nzz]

Had another look and you had a point, so env support is going into 1.13.0. All ten OIDC fields:

environment:
  - OIDC_ENABLED=true
  - OIDC_PROVIDER_URL=https://id.example.com/application/o/tm/
  - OIDC_CLIENT_ID=traefik-manager
  - OIDC_CLIENT_SECRET=your-client-secret
  - OIDC_DISPLAY_NAME=Authentik
  - OIDC_ALLOWED_EMAILS=
  - OIDC_ALLOWED_GROUPS=admins
  - OIDC_GROUPS_CLAIM=groups
  - OIDC_ALLOW_ANY_AUTHENTICATED=false
  - OIDC_AUTO_LOGIN=false

Same rule as DOMAINS and TRAEFIK_API_URL: the variable applies while the key is not in manager.yml, and once you save OIDC settings in the UI the file wins.

[xd003]

Thanks, much appeciated