SSO connectors — the Security extension family that lets people sign in to Kwirth with an external identity (Google, GitLab, GitHub) instead of, or alongside, a local account.
An Identity Provider (IdP) connector is an installable extension that implements an SSO protocol — OIDC or OAuth2 — against a specific provider. Once configured and enabled, a "Login with …" button appears on the sign-in screen.
The split is deliberate: the IdP only proves who the person is; Kwirth still decides whether they may enter and what they can do. The person must already exist as a Kwirth user, bound to that connector — there is no auto-provisioning.
Connectors are packaged independently, so more providers — including third-party ones — can be added over time.
For an IdP user to log in, all of these must hold:
Authorization (scopes & resources) is unchanged by SSO — it only changes how the person authenticates, never what they can do.
The sign-in is hardened with PKCE + state, a back-channel token exchange (the browser never sees provider tokens), a single-use login hand-off and anti open-redirect checks. Client secrets are stored write-only in a Kubernetes secret and never shown back.
Open ☰ → Manage extensions → Identity providers, install the connector if needed, then click its ⚙ gear and fill:
The OAuth/OIDC credentials from your provider app. Secret is write-only, shown masked.
The scopes requested from the provider (e.g. openid email profile).
Needed for self-managed / Enterprise variants to reach the right endpoint.
Text shown on the login screen, plus an enabled toggle that makes the button appear.
Then bind each person in User management: create a user whose Id is their verified email and set its IdP field to the connector. See Security → Single Sign-On.