Single sign-on (OIDC)

Single sign-on (SSO) lets people sign in to Tesria with an account they already have somewhere else, such as their work account, instead of a separate Tesria password. There is one password less to remember, and when someone’s work account is closed, they can no longer sign in with it here either.

Tesria works with any provider that speaks OpenID Connect (OIDC), the standard most of them use: Keycloak, Authentik, Okta, Microsoft Entra ID and Google among them. It sits alongside ordinary Tesria accounts, so nobody has to switch.

Before you start

• Administrator access to your provider, or someone who has it, to register Tesria there.

• The address people open Tesria at, because the provider sends people back to it after they sign in.

• Access to the server, to add the settings to .env.

Step 1: Register Tesria with your provider

In your provider’s admin console, add a new application (some call it a client). Choose the web or confidential type, and give it this redirect address:

https://your-server/signin-oidc

The provider then gives you three things to copy: its own address (called the authority or issuer), a client ID and a client secret.

Step 2: Add them to .env

OIDC_AUTHORITY=https://idp.example.com/realms/company
OIDC_CLIENT_ID=tesria
OIDC_CLIENT_SECRET=the-secret-from-the-provider
OIDC_DISPLAY_NAME=Company SSO

OIDC_DISPLAY_NAME is what the sign-in button says, here Sign in with Company SSO. Without it, the button says Sign in with Single sign-on.

Step 3: Restart Tesria

docker compose up -d app

Step 4: Try it

Sign out and open the sign-in page: it now has the Sign in with button. Choose it, sign in at your provider, and you come back to Tesria signed in. If something is wrong, you land back on the sign-in page with the reason.

Which account someone gets

• Someone who has signed in with SSO before gets the same account every time, even if their email address changes at the provider.

• Someone who already has a Tesria account with the same email address is connected to it, but only if the provider says it has confirmed that address. Otherwise anyone who could claim the address at the provider could take over the account.

• Someone new gets a new account with no Tesria password, as long as Allow public registration is on (Admin, Settings, Access). When it is off, they are turned away: send them an invite, let them create their account from it, and from then on SSO signs them in to that account. See Invites.

Testing with a provider on plain HTTP on the same machine? Add OIDC_REQUIRE_HTTPS_METADATA=false. Never leave it that way for a real provider.