OIDC Single Sign-On — Pro
Bichon Pro implements the OIDC Authorization Code flow with PKCE. ID tokens are verified against the provider's JWKS, and RP-initiated logout is supported. Any OIDC-compliant provider works, including:
- Keycloak
- Okta
- Microsoft Entra ID
- Google Workspace
- Auth0
Endpoints
| Method | Path | Description |
|---|---|---|
GET | /api/auth/oidc/login | Redirect to the provider's login page |
GET | /api/auth/oidc/callback | OIDC callback — exchanges the code for tokens |
GET | /api/auth/oidc/logout | RP-initiated logout |
GET | /api/auth/oidc/local-logout | Local session logout only |
Configuration
OIDC is configured with environment variables (or the matching CLI flags) — there is no WebUI settings page for it. All five are required:
| Variable | Description |
|---|---|
BICHON_OIDC_ENABLED | Set to true to enable OIDC login |
BICHON_OIDC_ISSUER_URL | Issuer URL, e.g. https://keycloak.example.com/realms/myorg |
BICHON_OIDC_CLIENT_ID | Client ID registered with the identity provider |
BICHON_OIDC_CLIENT_SECRET | Client secret registered with the identity provider |
BICHON_OIDC_REDIRECT_URI | Callback URL registered with the identity provider — normally https://<your-host>/api/auth/oidc/callback |
The authorization-code flow uses PKCE, verifies the ID token against the provider's JWKS, and supports RP-initiated logout. No scope list is configurable: the standard openid profile email scopes are requested. See Configuration Reference for the full list.
LDAP / Active Directory — Enterprise
The Enterprise edition adds LDAP bind-based authentication: the server binds to your directory server with the user's credentials — no browser redirect, no password ever stored. Supports StartTLS and LDAPS.
- JIT provisioning: first-time LDAP users are created automatically with
sso_provider = "ldap" - Configurable user filter and attribute mapping
- Requires both
BICHON_LDAP_ENABLEDand an Enterprise license - Supports
ldap://+ StartTLS andldaps://; certificate verification can be disabled for directory services with a private CA
| Variable | Default | Description |
|---|---|---|
BICHON_LDAP_ENABLED | false | Enable LDAP sign-in |
BICHON_LDAP_URL | — | ldap://host:389 or ldaps://host:636 |
BICHON_LDAP_BIND_DN | — | Service-account DN for the initial bind |
BICHON_LDAP_BIND_PASSWORD | — | Service-account password |
BICHON_LDAP_BASE_DN | — | Search base DN |
BICHON_LDAP_USER_FILTER | (&(objectClass=person)(sAMAccountName={username})) | User search filter; {username} is substituted |
BICHON_LDAP_SCOPE | subtree | Search scope: onelevel or subtree |
BICHON_LDAP_USERNAME_ATTRIBUTE | sAMAccountName | Attribute read as the local username |
BICHON_LDAP_SSO_ID_ATTRIBUTE | distinguishedName | Attribute stored as the user's SSO id |
BICHON_LDAP_STARTTLS | false | Upgrade ldap:// connections with StartTLS |
BICHON_LDAP_NO_TLS_VERIFY | false | Disable certificate verification (private CA only) |
BICHON_LDAP_TIMEOUT_SECS | 10 | LDAP operation timeout |
See Configuration Reference for descriptions of each setting.
| Method | Path | Description |
|---|---|---|
POST | /api/auth/ldap/login | LDAP bind login |
Note: SAML is not supported. Use OIDC for SSO — nearly all identity providers expose an OIDC endpoint.