sftpgo and OIDC intergation

[japatel]

I have install sftpgo on one of my AWS EC2 VMs. I wanted to setup OIDC in sftpgo for Web Interface and sftpd. Is there any document I can follow to setup this integration? I have two OIDC which I can use keyclock or AWS congnito.

[fostermi]

Set the following environment variables (this example uses Keycloak):

SFTPGO_HTTPD__BINDINGS__0__OIDC__CLIENT_ID: "sftpgo"
SFTPGO_HTTPD__BINDINGS__0__OIDC__CLIENT_SECRET: "<client_secret>"
SFTPGO_HTTPD__BINDINGS__0__OIDC__CONFIG_URL: "https://example.com/auth/realms/myrealm"
SFTPGO_HTTPD__BINDINGS__0__OIDC__REDIRECT_BASE_URL: "https://sftpgo.example.com"
SFTPGO_HTTPD__BINDINGS__0__OIDC__USERNAME_FIELD: "preferred_username"
SFTPGO_HTTPD__BINDINGS__0__OIDC__SCOPES: "openid,profile,email"

[lxp731]

Same problem, I use the Logto platform for unified login.
This is my Logto config:

I use RKE2 build sftpgo, the deployment configuration is as follows：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: sftpgo
  namespace: sftpgo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sftpgo
  template:
    metadata:
      labels:
        app: sftpgo
    spec:
      initContainers:
      - name: init-db
        image: harbor.frombyte.auto/library/busybox:latest
        command: ['sh', '-c', 'mkdir -p /srv/sftpgo /var/lib/sftpgo && chown -R 1000:1000 /srv/sftpgo /var/lib/sftpgo']
        volumeMounts:
        - name: data
          mountPath: /srv/sftpgo
        - name: home
          mountPath: /var/lib/sftpgo
      containers:
      - name: sftpgo
        image: sftpgo-zh-cn:v2.6
        ports:
        - containerPort: 8080
          name: web
        - containerPort: 2022
          name: sftp
        env:
        - name: SFTPGO_GRACE_TIME
          value: "32"
        - name: SFTPGO_HTTPD__BINDINGS__0__OIDC__CLIENT_ID
          value: "ten*******djyl"
        - name: SFTPGO_HTTPD__BINDINGS__0__OIDC__CLIENT_SECRET
          value: "c4xM***************mcrMMeI"
        - name: SFTPGO_HTTPD__BINDINGS__0__OIDC__CONFIG_URL
          value: "https://auth.frombyte.com/oidc"
        - name: SFTPGO_HTTPD__BINDINGS__0__OIDC__REDIRECT_BASE_URL
          value: "https://sftpgo.frombyte.auto"
        - name: SFTPGO_HTTPD__BINDINGS__0__OIDC__SCOPES 
          value: "openid,profile,email"
        - name: SFTPGO_HTTPD__BINDINGS__0__OIDC__USERNAME_FIELD
          value: "preferred_username"
        - name: SFTPGO_HTTPD__BINDINGS__0__OIDC__ROLE_FIELD
          value: "sftpgo_role"
        - name: SFTPGO_HTTPD__BINDINGS__0__FORCE_HTTPS
          value: "true"
        - name: SFTPGO_LOG_LEVEL
          value: "debug"
        volumeMounts:
        - name: data
          mountPath: /srv/sftpgo
        - name: home
          mountPath: /var/lib/sftpgo
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: sftpgo-data-pvc
      - name: home
        persistentVolumeClaim:
          claimName: sftpgo-home-pvc

The service is accessible：

When I log in with OpenID：

I don't know where the problem is, please help.

[marcorotella]

Hi @japatel in my scenario i had to append /web/oidc/redirect to the redirect uri in the app registration of the sso provider (Azure in my case) like this:

https://my.fqdn.com/web/oidc/redirect