Skip to main content
Rootprint supports one OpenID Connect (OIDC) provider alongside password, Google, and GitHub sign-in. Anyone the issuer authenticates can sign in. Rootprint keeps no allow-list of its own for OIDC, so restrict access at the identity provider. Authentication overview has the rules shared by every provider.

Setup

1

Register a client at your identity provider

Create a confidential OIDC client (an “application” or “web app” in most providers) with the authorization code flow enabled. Register this redirect URI:
Rootprint requests the openid, profile, and email scopes. Copy the Client ID and Client Secret.
2

Enter the issuer and credentials in Rootprint

In Rootprint, go to Settings → Authentication, then click Configure on the OpenID Connect row. Enter:
  • Issuer URL: the issuer as your provider publishes it, for example https://auth.example.com/realms/main. Rootprint appends /.well-known/openid-configuration itself.
  • Client ID and Client Secret: from the client you registered.
3

Save the configuration

Click Save. Rootprint fetches and validates the discovery document. If it rejects the issuer, it saves nothing and shows why. On success, a Continue with SSO button appears on the sign-in page.

Configure with environment variables

To keep the provider in your deployment config instead of the database, set all three variables and restart Rootprint:
Rootprint refuses to start if only some of them are set, or if the issuer URL is not https:// or http:// on a private network. Register the same redirect URI as in Setup. While the variables are set, Settings → Authentication shows the provider read-only. To change or remove it, update the variables and restart.
The variables replace any OpenID Connect settings saved in Settings → Authentication, and Rootprint deletes the saved ones at startup. Moving a provider from the UI to the variables unlinks every OpenID Connect account once, even with the same issuer and client ID. Removing the variables later turns OpenID Connect off and unlinks the accounts again.

Issuer requirements

Rootprint rejects the issuer and saves nothing unless:
  • The issuer URL and the discovery endpoints use https://. Plain http:// works only on a private network: loopback, private IP ranges, single-label hostnames such as dex, and names ending in .local or .internal. An https:// issuer cannot name an http:// endpoint.
  • The discovery document is reachable JSON with authorization_endpoint, token_endpoint, and jwks_uri, and its issuer field matches the URL you entered (a trailing slash is ignored).
  • If the document lists code_challenge_methods_supported, it includes S256. If it lists token_endpoint_auth_methods_supported, it includes client_secret_basic or client_secret_post.

Changing the issuer or client ID

Changing the Issuer URL or Client ID, in the form or through OIDC_ISSUER_URL and OIDC_CLIENT_ID, changes the identity behind every linked account. Rootprint unlinks every OpenID Connect account and signs those users out. They re-link by email on their next sign-in, or an admin can reset their password. Rotating only the client secret unlinks nobody.

Issuer unreachable at boot

If discovery fails while Rootprint starts, the Continue with SSO button stays hidden until a retry succeeds. OIDC_RETRY_MS and OIDC_DISCOVERY_TIMEOUT_MS set the retry interval and the fetch timeout. See Environment variables.