github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-09-06 12:09:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

📚 Clarify self-hosted OIDC configuration for containerized deployments (#9758)

Browse Source 
Signed-off-by: Francis Santiago <francis.santiago@kaleidos.net>
This commit is contained in:
Francis Santiago 2026-05-20 13:05:40 +02:00 committed by GitHub
parent 29d449b42f
commit 106b10e971
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
docs/technical-guide/configuration.md
View File

@ -171,13 +171,14 @@ PENPOT_OIDC_CLIENT_ID: <client-id>
# Mainly used for auto discovery the openid endpoints # Mainly used for auto discovery the openid endpoints
PENPOT_OIDC_BASE_URI: <uri> PENPOT_OIDC_BASE_URI: <uri>
PENPOT_OIDC_CLIENT_SECRET: <client-id> PENPOT_OIDC_CLIENT_SECRET: <client-secret>
# Optional backend variables, used mainly if you want override; they are # Optional backend variables, used mainly if you want override; they are
# autodiscovered using the standard openid-connect mechanism. # autodiscovered using the standard openid-connect mechanism.
PENPOT_OIDC_AUTH_URI: <uri> PENPOT_OIDC_AUTH_URI: <uri>
PENPOT_OIDC_TOKEN_URI: <uri> PENPOT_OIDC_TOKEN_URI: <uri>
PENPOT_OIDC_USER_URI: <uri> PENPOT_OIDC_USER_URI: <uri>
PENPOT_OIDC_JWKS_URI: <uri>
# Optional list of roles that users are required to have. If no role # Optional list of roles that users are required to have. If no role
# is provided, roles checking disabled. # is provided, roles checking disabled.
@ -187,6 +188,27 @@ PENPOT_OIDC_ROLES: "role1 role2"
# not provided, the roles checking will be disabled. # not provided, the roles checking will be disabled.
PENPOT_OIDC_ROLES_ATTR: PENPOT_OIDC_ROLES_ATTR:
``` ```
<p class="advice">
For self-hosted and containerized deployments, the autodiscovered OIDC endpoints are
not always enough. Some providers expose browser-facing endpoints through a public
hostname while the Penpot backend must reach the same provider through an
internal/container-resolvable hostname. In that case, explicitly set the OIDC endpoint
overrides above so the browser can use the public authorization endpoint while the
backend uses reachable token, userinfo, and JWKS endpoints.
</p>
If the backend needs to contact the OIDC provider through a hostname not already allowed
by SSRF protection, add it to:
```bash
# Backend
# Space separated list of allowed hosts
PENPOT_SSRF_ALLOWED_HOSTS: "<internal-provider-host> <public-provider-host>"
```
This is commonly required when the provider is reachable from the browser via a public
URL but from the backend via a different internal hostname.
<br /> <br />
__Since version 1.6.0__ __Since version 1.6.0__