strapi-plugin-oidc

Single sign-on for Strapi 5! Log in to the administration screen using an OpenID Connect (OIDC) provider.

Optionally overwrites Strapi's default admin login page and endpoints.

Installation

yarn add @aartoni/strapi-plugin-oidc

or

npm i @aartoni/strapi-plugin-oidc

Configuration

With OIDC Discovery (recommended: the plugin auto-resolves endpoints from your provider):

export default ({ env }) => ({
  "oidc": {
    enabled: true,
    config: {
      issuer: "https://your-oidc-provider.com",
      clientId: "[Client ID from the provider]",
      clientSecret: "[Client secret from the provider]",
      redirectUri: "https://your-strapi/api/oidc/callback",
      scopes: "openid profile email groups",
    },
  },
});

Full options

Discoverable options are only required when discovery is false.

| Key | Required | Default | Description | |---|---|---|---| | issuer | yes | – | Provider issuer URL (used for discovery and id_token validation) | | discovery | no | true | Enable OIDC Discovery | | clientId | yes | – | OIDC client ID | | clientSecret | yes | – | OIDC client secret | | redirectUri | yes | – | Callback URL after login | | scopes | no | "openid profile email groups" | Space-separated OIDC scopes | | authorizationEndpoint | discoverable | – | Provider authorization endpoint | | tokenEndpoint | discoverable | – | Provider token endpoint | | userInfoEndpoint | discoverable | – | Provider userinfo endpoint | | jwksUri | discoverable | – | Provider JWKS URI | | familyNameField | no | "family_name" | Userinfo claim for last name | | givenNameField | no | "given_name" | Userinfo claim for first name | | rememberMe | no | true | Store JWT in localStorage (true) or cookie (false) |

Optional routing

To overwrite Strapi's default admin login page, you'll have to add an explicit Vite configuration and import the provided plugin.

import { oidcAuthPagePlugin } from '@aartoni/strapi-plugin-oidc/vite';
import { mergeConfig } from 'vite';

export default (config) =>
  mergeConfig(config, { plugins: [oidcAuthPagePlugin()] });

However, this is not enough to guarantee that your Strapi users won't try to login via API. To address that concern, you should load the provided middleware in your config/middlewares.ts.

// Default Strapi middleware stack, plus the native-auth blocker.
export default [
  "strapi::logger",
  "strapi::errors",
  "strapi::security",
  "strapi::cors",
  // ...
  "plugin::oidc.block-native-auth",
];

Add after the default stack, placing it earlier can block admin panel routes.

Role mapping

Admin roles can be mapped from OIDC claims using JMESPath expressions. You can edit the expression from this plugin's page in the admin sidebar, but no user can log in until one is set, so bootstrap an initial expression in src/index.ts (or equivalent) before first startup. See playground/src/index.ts for a working example.

OIDC provider

See the Docker compose file for an example of how to set-up Authelia as an OIDC provider.

Commercial providers might ship OIDC support, including:

• Google Identity Platform
• Amazon Cognito
• Microsoft Entra

Development

See CONTRIBUTING.md.