SSO

Single Sign-On (SSO) and authentication providers settings

Forward Auth

Configuration settings for the Forward Auth provider.

The Forward Auth provider makes a subrequest to an authorization server that supports Forward Auth, then either:

Example authorization servers that support this:

The full remote address or URL of the authorization servers forward auth endpoint. Example: https://auth.example.com/authz/forward-auth
Advanced Options
Comma separated list of case-insensitive headers to copy from the authorization servers response to the request sent to the backend. If not set no headers are copied.
Example: Remote-User,Remote-Groups,Remote-Email,Remote-Name
Comma separated list of case-insensitive headers to copy from the authorization servers response to the response sent to the client. If not set no headers are copied.
Example: Set-Cookie,WWW-Authenticate
Comma separated list of case-insensitive headers to copy from the original request to the request made to the authorization server. If not set all headers are copied.
Recommendation: Generally it's recommended to leave this blank or use the below example for predictable results.
Example: Accept,X-Requested-With,Cookie,Authorization,Proxy-Authorization
Comma separated list of case-sensitive cookie names to copy from the original request to the request made to the authorization server. If not set all cookies are included. This allows omitting all cookies not required by the authorization server.
Example: authelia_session,another_session
Comma separated list of case-sensitive cookie names to exclude from the request made to the backend application. If not set no cookies are excluded. This allows omitting the cookie intended only for the authorization server.
Example: authelia_session,another_session

OAuth 2.0

Configuration settings for OAuth 2.0 authentication provider.

Public identifier of the OAuth2 application
Secret key of the OAuth2 application
URL to the OIDC discovery document (usually ending with /.well-known/openid-configuration). Used to automatically fetch provider settings.
URL used to authenticate against the OAuth2 provider. Will redirect the user to the OAuth2 provider login view. Optional if Well-Known url is configured.
URL used by Zoraxy to exchange a valid OAuth2 authentication code for an access token. Optional if Well-Known url is configured.
URL used by the OAuth2 provider to validate generated token. Optional if Well-Known url is configured.
Scopes required by the OAuth2 provider to retrieve information about the authenticated user. Refer to your OAuth2 provider documentation for more information about this. Optional if Well-Known url is configured.

Zoraxy SSO

Configuration settings for Zoraxy SSO provider.

Currently not implemented.