From 8ac121517d5527ec03904122bc88ceaec4fb9124 Mon Sep 17 00:00:00 2001
From: 3wc <3wc@doesthisthing.work>
Date: Wed, 9 Sep 2026 21:08:01 -0400
Subject: [PATCH 1/2] feat: SSO with OIDC..

..https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect
---
 .env.sample        | 11 +++++++++++
 abra.sh            |  2 +-
 compose.oidc.yml   | 20 ++++++++++++++++++++
 entrypoint.sh.tmpl |  4 ++++
 4 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 compose.oidc.yml

diff --git a/.env.sample b/.env.sample
index 8ba11fa..6d5b772 100644
--- a/.env.sample
+++ b/.env.sample
@@ -36,3 +36,14 @@ TX="Europe/Berlin"
 #SMTP_DEBUG=true
 
 #DISABLE_IPV6=0
+
+## Single Sign On (OpenID Connect / OIDC) settings
+#COMPOSE_FILE="$COMPOSE_FILE:compose.oidc.yml"
+#SSO_ENABLED=true
+#SSO_ONLY=false
+#SSO_AUTHORITY=https://auth.example.com
+#SSO_SCOPES=profile email offline_access vaultwarden
+#SSO_PKCE=true
+#SSO_CLIENT_ID=vaultwarden
+#SSO_CLIENT_SECRET=insecure_secret
+#SECRET_SSO_SECRET_VERSION=v1
diff --git a/abra.sh b/abra.sh
index 47dbfa7..1816838 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,4 +1,4 @@
-export APP_ENTRYPOINT_VERSION=v4
+export APP_ENTRYPOINT_VERSION=v5
 APP_DIR="app:/data"
 
 insert_vaultwarden_admin_token() {
diff --git a/compose.oidc.yml b/compose.oidc.yml
new file mode 100644
index 0000000..30c1b40
--- /dev/null
+++ b/compose.oidc.yml
@@ -0,0 +1,20 @@
+---
+version: "3.8"
+
+services:
+  app:
+    environment:
+      - SSO_ENABLED=true
+      - SSO_ONLY
+      - SSO_AUTHORITY
+      - SSO_SCOPES
+      - SSO_PKCE
+      - SSO_CLIENT_ID
+      - SSO_CLIENT_SECRET_FILE=/run/secrets/sso_secret
+    secrets:
+      - sso_secret
+
+secrets:
+  sso_secret:
+    external: true
+    name: ${STACK_NAME}_sso_secret_${SECRET_SSO_SECRET_VERSION}
diff --git a/entrypoint.sh.tmpl b/entrypoint.sh.tmpl
index cdb5955..efab94f 100644
--- a/entrypoint.sh.tmpl
+++ b/entrypoint.sh.tmpl
@@ -52,6 +52,10 @@ file_env "ADMIN_TOKEN"
 file_env "SMTP_PASSWORD"
 {{ end }}
 
+{{ if eq (env "SSO_ENABLED") "true" }}
+file_env "SSO_CLIENT_SECRET"
+{{ end }}
+
 # remove world permissions on data
 chmod -R o= /data
 
-- 
2.54.0


From e05abdefe035772776eafd7fe8f3dad55c9d15fb Mon Sep 17 00:00:00 2001
From: 3wc <3wc@doesthisthing.work>
Date: Wed, 9 Sep 2026 21:14:18 -0400
Subject: [PATCH 2/2] docs: Add SSO docs

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 2f52d0e..60cadce 100644
--- a/README.md
+++ b/README.md
@@ -47,3 +47,7 @@ LOG_LEVEL=warn
 Then follow [this guide](https://github.com/dani-garcia/vaultwarden/wiki/Fail2Ban-Setup).
 
 And you must use `COMPOSE_FILE="$COMPOSE_FILE:compose.host.yml"` in your traefik config to get real IPs.
+
+### Single Sign On with OpenID Connect (OIDC)
+
+Uncomment the "Single Sign On" section in your app config. See the [upstream docs](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) for more, including specific configuration examples for Keycloak and Authentik.
-- 
2.54.0