Add native Pocket ID OIDC tutorials across the app guides

2026-09-02 19:28:29 +02:00
parent bb8581a535
commit dd95694492
5 changed files with 214 additions and 17 deletions
@@ -142,7 +142,7 @@ Restart the stack by clicking "Deploy" and wait for SWAG to be fully operational
 In SWAG's config folder, create the file `vault.subdomain.conf`:

 ::tip{icon=""}
-✨ __Tip:__ Use [File Browser](/serveex/files/file-browser) to navigate and edit files instead of using terminal commands.
+✨ __Tip:__ Use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit files instead of using terminal commands.
 ::

 ```bash [Terminal]
@@ -241,6 +241,71 @@ And there you go! Vaultwarden is now exposed! Visit `https://vault.yourdomain.co

 Don't forget to install Bitwarden browser extensions (they work with Vaultwarden) for [Chrome](https://chromewebstore.google.com/detail/gestionnaire-de-mots-de-p/nngceckbapebfimnlniiiahkandclblb) and [Firefox](https://addons.mozilla.org/fr/firefox/addon/bitwarden-password-manager/), as well as [iOS](https://apps.apple.com/fr/app/bitwarden/id1137397744) and [Android](https://play.google.com/store/apps/details?id=com.x8bit.bitwarden&hl=fr) apps to sync your passwords.

-::tip{icon=""}
-✨ __Tip:__ You can protect this app with [TinyAuth](/serveex/security/tinyauth) and [Pocket ID](/serveex/security/pocket-id) using the reverse-proxy pattern from the TinyAuth guide, or with Authentik by opening `tools.subdomain.conf` and removing the `#` in front of `include /config/nginx/authentik-server.conf;` and `include /config/nginx/authentik-location.conf;`. Don't forget to [create an application and provider in Authentik](/serveex/advanced/authentik#protecting-an-app-via-reverse-proxy).
+## Protecting Vaultwarden with Pocket ID
+Unlike most apps on this site, Vaultwarden supports OIDC natively, so there's no need for TinyAuth's forward-auth proxy or Authentik's reverse-proxy trick here: Vaultwarden itself can require an OIDC login before letting anyone into the vault.
+
+::steps{level="3"}
+### Register Vaultwarden as an OIDC client
+
+[Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) (or in Authentik, or any other OIDC provider) using this callback URL:
+
+```text
+https://vault.yourdomain.com/identity/connect/oidc-signin
+```
+
+### Add the SSO variables
+
+Edit Vaultwarden's `.env` file:
+
+```bash [Terminal]
+sudo nano /docker/vaultwarden/.env
+```
+
+Add the following:
+
+```properties [.env]
+SSO_ENABLED=true
+SSO_ONLY=true
+SSO_AUTHORITY=https://id.yourdomain.com
+SSO_CLIENT_ID=
+SSO_CLIENT_SECRET=
+```
+
+| Variable | Value |
+|----------|-------|
+| `SSO_AUTHORITY`{lang=properties} | Your OIDC provider's public URL (Pocket ID here) |
+| `SSO_CLIENT_ID`{lang=properties} | The client ID copied from your provider |
+| `SSO_CLIENT_SECRET`{lang=properties} | The client secret copied from your provider |
+
+::note
+
+Set `SSO_ONLY=false` instead if you'd rather keep the option to log in with a local master password too.
+::
+
+Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
+
+### Redeploy the stack
+
+Redeploy Vaultwarden. Your next visit to `https://vault.yourdomain.com` will prompt for SSO login instead of (or alongside) the local master password.
+
+### Done !
+::
+
+::note
+See the [Vaultwarden SSO wiki](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) for the full list of options, including per-organization enforcement and master password policies.
+::
+
+::tip
+✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID:
+
+1. In Authentik, create a scope mapping named `email` with the expression `return {"email": request.user.email, "email_verified": True}` (Vaultwarden requires this claim).
+2. Create an application and an OAuth2/OpenID Connect provider named `Vaultwarden`, with a redirect URI (type `Strict`) of `https://vault.yourdomain.com/identity/connect/oidc-signin`. Under Advanced protocol settings, set the access token validity to more than 5 minutes, replace the default email scope with your custom mapping, and add the `offline_access` scope mapping.
+3. Note the provider's __Client ID__, __Client Secret__, and __Slug__, then use them in Vaultwarden's `.env`:
+
+```properties [.env]
+SSO_AUTHORITY=https://authentik.yourdomain.com/application/o/<slug>/
+SSO_CLIENT_ID=
+SSO_CLIENT_SECRET=
+SSO_SCOPES=email profile offline_access
+```
 ::