From 106b10e971837072b574ef0ac0c62d6a7fe64737 Mon Sep 17 00:00:00 2001 From: Francis Santiago Date: Wed, 20 May 2026 13:05:40 +0200 Subject: [PATCH] :books: Clarify self-hosted OIDC configuration for containerized deployments (#9758) Signed-off-by: Francis Santiago --- docs/technical-guide/configuration.md | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/docs/technical-guide/configuration.md b/docs/technical-guide/configuration.md index ddbe801fd7..87ee6182b8 100644 --- a/docs/technical-guide/configuration.md +++ b/docs/technical-guide/configuration.md @@ -171,13 +171,14 @@ PENPOT_OIDC_CLIENT_ID: # Mainly used for auto discovery the openid endpoints PENPOT_OIDC_BASE_URI: -PENPOT_OIDC_CLIENT_SECRET: +PENPOT_OIDC_CLIENT_SECRET: # Optional backend variables, used mainly if you want override; they are # autodiscovered using the standard openid-connect mechanism. PENPOT_OIDC_AUTH_URI: PENPOT_OIDC_TOKEN_URI: PENPOT_OIDC_USER_URI: +PENPOT_OIDC_JWKS_URI: # Optional list of roles that users are required to have. If no role # is provided, roles checking disabled. @@ -187,6 +188,27 @@ PENPOT_OIDC_ROLES: "role1 role2" # not provided, the roles checking will be disabled. PENPOT_OIDC_ROLES_ATTR: ``` + +

+For self-hosted and containerized deployments, the autodiscovered OIDC endpoints are +not always enough. Some providers expose browser-facing endpoints through a public +hostname while the Penpot backend must reach the same provider through an +internal/container-resolvable hostname. In that case, explicitly set the OIDC endpoint +overrides above so the browser can use the public authorization endpoint while the +backend uses reachable token, userinfo, and JWKS endpoints. +

+ +If the backend needs to contact the OIDC provider through a hostname not already allowed +by SSRF protection, add it to: + +```bash +# Backend +# Space separated list of allowed hosts +PENPOT_SSRF_ALLOWED_HOSTS: " " +``` + +This is commonly required when the provider is reachable from the browser via a public +URL but from the backend via a different internal hostname.
__Since version 1.6.0__