Hello, everyone. I am planning to set up Single Sign-On (SSO). I wonder if I can use something like Red Hat SSO with two separate domains. I have one domain for Windows AD and one for Linux IDM. My idea is to use Red Hat SSO so that both domains will be able to access the same services. For example, I have one Nextcloud instance, and I would like users from both domains to use it with SSO.
Highly recommend Authentik for SSO.
I run it on it’s own sub domain and all my other apps on their own sub domains.
It has pretty much every login protocol you could want (oauth, saml, ldap) etc.
Currently using it for jellyfin, immich, linkwarden, freshrss, and seafile.
Does it work for multiple domains (not Subdomains)? I’m currently using authelia, which can’t do that, which sucks.
I can’t imagine why it wouldn’t. The configuration just needs a URL, what domain they are actually on should be irrelevant.
For authelia, iirc it’s a problem with the way cookies work, but also with how they set their system up structurally. I don’t know the details anymore.
This is the way. I just hope they don’t start gatekeeping essential features behind the “enterprise” license. Already they have announced push-based 2fa (like Duo) will be enterprise which is a bit of a bummer but it’s honestly awesome software otherwise and beggars can’t be choosers!
Sorry for a noobie question. But when people say using SSO for internal apps, does it mean we only need to log in once and then the various apps won’t need us logging in again? And then the browser can stay connected for however long we want it to be?
This is typically the case. Increasingly, self-hosted apps use integrated OIDC or OAuth but for those that don’t there are various other methods of integration into the SSO provider you’re using including forward auth and remote username. Authentik is nice in that it is also a forward-auth proxy and so you don’t need to use an additional oauth proxy software like oauth2-proxy.
It it useful to use authentik with vaultwarden? Or is it redundant?