Single sign-on (OIDC)

Galene can offer Continue with SSO on the sign-in page. The browser goes to your identity provider, then returns to Galene. Galene creates its own session cookie. The identity provider does not sit in front of the app.

This is app-native OIDC. Reverse-proxy forward-auth (Authentik outpost, oauth2-proxy, and similar) is a different design and is not the household path.

Examples below use https://galene.example for the app and https://auth.example for the identity provider.

What you get

• Password and authenticator-app MFA stay available when mode is Optional (the default).
• Required sends /login straight to the identity provider. Local password stays at /login?local=1. Callback errors include a Use local password link to that address.
• An existing Galene user is matched by email (case-insensitive). An unknown email shows a calm error. Galene does not create a user from the identity provider.
• Sign out clears the Galene session only. It does not sign the browser out of the identity provider.

Take a backup before upgrading an image that includes this schema change.

Authentik

Step-by-step provider setup, the Settings field map, and callback troubleshooting are on Authentik (OIDC).

Short version: create an OAuth2/OpenID provider, set the redirect URI to https://galene.example/auth/oidc/callback, and copy the issuer, client ID, and client secret into Settings → Security.

Galene fields

An administrator opens Settings → Security → Single sign-on (OIDC):

Field	Example
Enable	On. Optional shows Continue with SSO. Required starts SSO from /login.
Issuer URL	https://auth.example/application/o/galene/
Client ID	value from the provider
Client secret	value from the provider (masked after save; Show / Hide)
Scopes	openid profile email
Mode	Optional (default) or Required. Required auto-starts SSO. /login?local=1 keeps the password form.
User mapping	Match by email. Create-on-first-login is off.
Redirect URI	Read-only. Copy into the provider.

Test connection loads the issuer’s /.well-known/openid-configuration and checks the client against the token endpoint. A provider that does not allow the client-credentials grant can still report success when discovery works and the token endpoint recognizes the client.

The same issuer URL works for any generic OIDC provider that publishes discovery and returns an email claim. Authentik is the provider these steps were written for.

Environment variables

A non-empty GALENE_OIDC_* variable overrides the matching Settings field at runtime. The database copy remains, so clearing the variable falls back to what was saved in Settings.

Variable	Overrides
GALENE_OIDC_ENABLED	1 / 0 (and the usual true/false aliases)
GALENE_OIDC_MODE	optional or required
GALENE_OIDC_ISSUER	Issuer URL
GALENE_OIDC_CLIENT_ID	Client ID
GALENE_OIDC_CLIENT_SECRET	Client secret (not shown back in Settings)
GALENE_OIDC_SCOPES	Scope string

Prefer Settings for a household install. Use the environment when the secret should stay out of the database.

Behind TLS, keep cookie and proxy settings as you already do (GALENE_COOKIE_SECURE, PROTOCOL_HEADER). The SSO session cookie uses the same flags as a password session. The public origin Galene builds for the redirect URI comes from those proxy headers.

Sign-in

1. Create the Galene user first (Settings → Users, or the first-run account) with the same email the identity provider will send.
2. Enable Optional, save, and test the connection.
3. Sign out. In Optional mode, use Continue with SSO on the sign-in page. In Required mode, opening /login starts the identity provider on its own. Open /login?local=1 for the password form, or use Use local password on a callback error.
4. After the identity provider approves the sign-in, Galene opens the home page. There is no Welcome back step. The account menu says Signed in via SSO.

If the email is not a Galene user, the callback explains that and offers Back to sign in. No new user row is created.