Last Updated: 3/7/2026

SSO (Single-Sign-On) with OAuth or OIDC

Table of Contents

You can connect LinkAce with an OAuth or OIDC provider to manage your users at a central place and let them login to LinkAce with a single click. No separate registration needed. No duplicate passwords to save.

LinkAce supports various OAuth or OIDC providers.

Supported providers

• Generic OIDC provider
• Auth0
• Authelia
• Authentik
• AWS Cognito
• FusionAuth
• Google
• GitHub
• GitLab
• Keycloak
• Microsoft Azure
• Okta
• Zitadel

General Configuration

To enable and configure Single Sign On, add the following configuration to your .env file. Please note that every SSO provider has its own configuration which must be added to the .env file and properly set up if you want to use it.

User handling

While a user tries to login with any SSO provider, this is how the user account is handled:

• If a user with the same email address already exists, but no SSO details are present yet, this user is automatically connected to the user provided by the SSO provider. An internal ID is stored for that user.
• If a user with the same email address already exists and SSO details are present, the user is logged in and those fields are updated:
  • user name
  • authentication token (if applicable)
• If no user with the same email address exists, a new user is registered and the user is automatically logged in.

If you disable your SSO provider after users registered with it, those users must manually reset their password via the regular password reset feature.

Example Configuration

SSO_ENABLED=true REGULAR_LOGIN_DISABLED=true SSO_AUTH0_ENABLED=true SSO_AUTH0_BASE_URL=https://example.auth0.com/ SSO_AUTH0_CLIENT_ID=W+qVVdlLP32a2F..... SSO_AUTH0_CLIENT_SECRET=U5qo0Le2stKK2vO87TTl..... 

After adding this to your .env file, the regular login form vanishes and a button to login with Auth0 will show up when users try to login.

Callback URL is https://[[YOUR.LINKACE.INSTALL]]/auth/sso/[[SERVICE]]/callback (replace service with whatever comes between SSO_[[SERVICE]]_ENABLED in your .env file)

Provider Configuration

Generic OpenID Connect Provider

The base URL must be set to the OpenID Configuration URL, but excluding the .well-known/openid-configuration part. Example: If https://auth.company.com/application/linkace/.well-known/openid-configuration is your OIDC configuration URL, then https://auth.company.com/application/linkace must be your base URL.

Auth0

Authelia

OIDC with Authelia works with the generic OIDC config. The critical succesfactor is the Authelia config, where PKCE needs to be disabled.

configuration.yml (Authelia)

identity_providers: identity_providers: identity_providers oidc:  oidc: oidc clients:  clients: clients - client_id: 'linkace'  - client_id: 'linkace' client_id 'linkace' client_name: 'linkace'  client_name: 'linkace' client_name 'linkace' client_secret: '[DIGEST OF SSO_OIDC_CLIENT_SECRET]'  client_secret: '[DIGEST OF SSO_OIDC_CLIENT_SECRET]' client_secret'[DIGEST OF SSO_OIDC_CLIENT_SECRET]' public: false  public: false public false authorization_policy: 'two_factor'  authorization_policy: 'two_factor' authorization_policy 'two_factor' require_pkce: false  require_pkce: false require_pkce false redirect_uris:  redirect_uris: redirect_uris - 'https://linkace.example.com/auth/sso/oidc/callback'  - 'https://linkace.example.com/auth/sso/oidc/callback' 'https://linkace.example.com/auth/sso/oidc/callback' scopes:  scopes: scopes - 'openid'  - 'openid' 'openid' - 'groups'  - 'groups' 'groups' - 'email'  - 'email' 'email' - 'profile'  - 'profile' 'profile' response_types:  response_types: response_types - 'code'  - 'code' 'code' grant_types:  grant_types: grant_types - 'authorization_code'  - 'authorization_code' 'authorization_code' - 'refresh_token'  - 'refresh_token' 'refresh_token' access_token_signed_response_alg: 'none'  access_token_signed_response_alg: 'none' access_token_signed_response_alg 'none' userinfo_signed_response_alg: 'none'  userinfo_signed_response_alg: 'none' userinfo_signed_response_alg 'none' token_endpoint_auth_method: 'client_secret_post'  token_endpoint_auth_method: 'client_secret_post' token_endpoint_auth_method 'client_secret_post'

LinkAce configuration

Authentik

AWS Cognito

FusionAuth

Google

GitHub

GitLab

Keycloak

Microsoft Azure

Okta

Zitadel