SSO/OIDC with Zitadel
Hey yall, I racked my brain for a very long time on why zitadel was not passing roles to homarr which meant I could not create an admin user, well I have found the reason and solution, so this is more for people with my own setup which is homarr 1.0+ along with Zitadel for SSO.
The simple reason why Homarr does not like Zitadel is seemingly homarr only supports flat roles whereas Zitadel traverses a complex role json structure. Here is how I got it working:
Adding Zitadel SSO to homarr
Zitadel setup:
- Create application
- Web + Basic Auth
- Redirect URIs:
- https://home.domain.com/api/auth/callback/oidc
- Token Settings:
- Bearer Token -> User Roles inside ID Token -> User Info inside ID Token
- Create a zitadel action:
- name: onlyRoles
- Flows -> Complement Token -> Pre UserInfo Creation + Pre Access Token Creation
- Add admin role to zitadel and assign user to it, in my case role and key were both called "admin"
Add OIDC client and secret to homarr (docker compose environment variables):
Startup homarr
Enter admin group name in homarrs web ui: "admin"
login with Zitadel and you are an admin, woooo
The simple reason why Homarr does not like Zitadel is seemingly homarr only supports flat roles whereas Zitadel traverses a complex role json structure. Here is how I got it working:
Adding Zitadel SSO to homarr
Zitadel setup:
- Create application
- Web + Basic Auth
- Redirect URIs:
- https://home.domain.com/api/auth/callback/oidc
- Token Settings:
- Bearer Token -> User Roles inside ID Token -> User Info inside ID Token
- Create a zitadel action:
- name: onlyRoles
- Flows -> Complement Token -> Pre UserInfo Creation + Pre Access Token Creation
- Add admin role to zitadel and assign user to it, in my case role and key were both called "admin"
Add OIDC client and secret to homarr (docker compose environment variables):
Startup homarr
Enter admin group name in homarrs web ui: "admin"
login with Zitadel and you are an admin, woooo
Solution
Great, thanks for this writeout. We got another user that had a similar problem with keycloak and there exists a github issue to solve this in the future with allowing object paths:
https://github.com/homarr-labs/homarr/issues/2657
https://github.com/homarr-labs/homarr/issues/2657
GitHub
Describe the bug I have a homarr group called "admins" with admin privileges. In Keycloak, in Client scopes -> roles -> mappers -> roles, the "client roles" mapper has ...
