.env.sample

@@ -36,3 +36,14 @@ TX="Europe/Berlin"
 #SMTP_DEBUG=true
 
 #DISABLE_IPV6=0
+
+## Single Sign On (OpenID Connect / OIDC) settings
+#COMPOSE_FILE="$COMPOSE_FILE:compose.oidc.yml"
+#SSO_ENABLED=true
+#SSO_ONLY=false
+#SSO_AUTHORITY=https://auth.example.com
+#SSO_SCOPES=profile email offline_access vaultwarden
+#SSO_PKCE=true
+#SSO_CLIENT_ID=vaultwarden
+#SSO_CLIENT_SECRET=insecure_secret
+#SECRET_SSO_SECRET_VERSION=v1

README.md

@@ -47,3 +47,7 @@ LOG_LEVEL=warn
 Then follow [this guide](https://github.com/dani-garcia/vaultwarden/wiki/Fail2Ban-Setup).
 
 And you must use `COMPOSE_FILE="$COMPOSE_FILE:compose.host.yml"` in your traefik config to get real IPs.
+
+### Single Sign On with OpenID Connect (OIDC)
+
+Uncomment the "Single Sign On" section in your app config. See the [upstream docs](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect) for more, including specific configuration examples for Keycloak and Authentik.

abra.sh

@@ -1,4 +1,4 @@
-export APP_ENTRYPOINT_VERSION=v4
+export APP_ENTRYPOINT_VERSION=v5
 APP_DIR="app:/data"
 
 insert_vaultwarden_admin_token() {

compose.oidc.yml

@@ -0,0 +1,20 @@
+---
+version: "3.8"
+
+services:
+  app:
+    environment:
+      - SSO_ENABLED=true
+      - SSO_ONLY
+      - SSO_AUTHORITY
+      - SSO_SCOPES
+      - SSO_PKCE
+      - SSO_CLIENT_ID
+      - SSO_CLIENT_SECRET_FILE=/run/secrets/sso_secret
+    secrets:
+      - sso_secret
+
+secrets:
+  sso_secret:
+    external: true
+    name: ${STACK_NAME}_sso_secret_${SECRET_SSO_SECRET_VERSION}

entrypoint.sh.tmpl

@@ -52,6 +52,10 @@ file_env "ADMIN_TOKEN"
 file_env "SMTP_PASSWORD"
 {{ end }}
 
+{{ if eq (env "SSO_ENABLED") "true" }}
+file_env "SSO_CLIENT_SECRET"
+{{ end }}
+
 # remove world permissions on data
 chmod -R o= /data