Configure OIDC with Authentik

This page explains how to integrate Authentik as an OpenID Connect (OIDC) identity provider to authenticate your users on Reemo.

Note

Depending on your deployment mode, SSO can be enabled at the instance level (Private Cloud / On-Prem) or at the organization level (Public Cloud).
Screenshots and labels may vary slightly depending on your interface version.

Configure SSO in Reemo

Case 1: Instance level (Private Cloud / On-Prem)
From verified_user Admin Area > dashboard General > passkey SSO Connectors, configure SSO for the instance.
Access SSO Connectors in the instance Admin Area

Access SSO Connectors in the instance Admin Area.

Case 2: Organization level (Public Cloud)
From domain Organization > dashboard General > passkey SSO Connectors, configure SSO for that organization.
Configure SSO in Organization > SSO Connectors

Configure SSO in Organization > SSO Connectors.

Create the OIDC connector in Reemo

  1. From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors and click New Connector > New OIDC Connector.

  2. Enter the Friendly Name (e.g. Authentik). The Issuer URL, Client ID and Client Secret fields will be filled in after the Authentik configuration.

OIDC connector creation form

OIDC connector creation form.

  1. Click Create to generate the connector’s callback URL. You will need it in Authentik.

Retrieving the OIDC callback URL

Copy the callback URL generated by the OIDC connector.

Configure the OIDC provider in Authentik

Log in to the Authentik admin interface (https://[authentik_url]/if/admin/).

  1. In Applications > Applications, click Create with Wizard. Enter the application name (e.g. reemo) then choose an OAuth2/OpenID Provider.

  2. Configure the provider:

    • Client type: Confidential.

    • Redirect URIs: paste the callback URL from the Reemo connector (Strict mode).

    • Signing Key: select a certificate (e.g. authentik Self-signed Certificate).

    • Scopes: openid, profile, email.

Warning

Make sure the provider allows the Authorization Code flow (Grant Types field). The wizard enables it by default; without it, Authentik rejects the authorization request (invalid_request).

Authentik OIDC provider configuration

Client Type, Client ID / Secret and Grant Types (Authorization Code) of the provider.

  1. Open the provider (Applications > Providers > reemo). The Overview tab provides everything Reemo needs:

    • Client ID and Client Secret (the latter via Edit).

    • OpenID Configuration Issuer, in the format https://[authentik_url]/application/o/[slug]/.

Authentik OIDC provider overview

Retrieve the Client ID, the OpenID Issuer and the provider endpoints.

Complete the OIDC connector in Reemo

Complete the connector with the Authentik information:

  • Issuer URL: https://[authentik_url]/application/o/[slug]/. Reemo auto-discovers the endpoints from <issuer>/.well-known/openid-configuration.

  • Client ID and Client Secret of the Authentik provider.

  • Scopes: leave empty to use openid profile email by default.

  • Attributes (optional): leave empty to use the standard OIDC attributes (preferred_username, email, name).

Complete the OIDC connector in Reemo

Enter Issuer URL, Client ID and Client Secret, then enable the connector.

Enable the connector (check Enabled) then click Update (or Create) to save.

Declare users

Two approaches are available to grant SSO access to users.

Approach A: Explicit provisioning from the organization
From verified_user Admin Area > domain Organizations, select your organization, then go to inventory_2 Inventory > person Users and click New User > Provision SAML User to add users by entering their email.
New User menu with the Provision SAML User option

Select Provision SAML User from the New User menu.

The same button provisions both SAML and OIDC users.

Approach B: Just-In-Time (JIT) Provisioning
From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors, click the connector then enable Just In Time Provisioning: accounts are created automatically on the first successful login.
Just In Time Provisioning option on the OIDC connector

Enable Just In Time Provisioning to create accounts on first login.

Manage rights dynamically from the directory

Reemo can read each user’s group membership and automatically assign access to the corresponding collections.

In Authentik

Authentik’s profile scope includes a groups claim by default, containing the user’s group names. Make sure the profile scope is assigned to the provider (see above), then create your groups under Directory > Groups and add users to them.

Note

For full control over the claim content, you can create a dedicated Scope Mapping (Customization > Property Mappings) emitting the groups claim.

In Reemo

  1. Open the OIDC connector form (Admin Area > General > SSO Connectors), Extra mapping section.

  2. In the Collection field, enter groups, then click Update.

Extra Mapping section of the connector

Enter the group claim name in the Collection field of Extra Mapping.

  1. In Inventory > Collections, edit a collection and fill the SSO Mapping Identifier field with the corresponding group name.

Log in via OIDC

Once the connector is active and users are declared (or JIT is enabled), your users select the OIDC tab on the login screen, pick the connector, and are redirected to Authentik.

OIDC tab on the login screen

Select the OIDC tab then the connector to be redirected to Authentik.