authentik

Connect Windshift to authentik for single sign-on using OpenID Connect.

Prerequisites

  • A running Windshift instance with admin access.
  • A running authentik instance with admin access.

Step 1: Open SSO Configuration in Windshift

  1. Navigate to Admin > Single Sign-On.
  2. Click Add Provider.
  3. Enter a display name, such as "authentik". Windshift fills the slug automatically.
  4. Copy the Callback URL in the dialog.

Step 2: Create an OAuth2/OpenID Provider in authentik

  1. In authentik admin, go to Applications > Providers and click Create.
  2. Select OAuth2/OpenID Provider and click Next.
  3. Enter a name, such as "Windshift".
  4. Set Client type to Confidential.
  5. Paste the Windshift Callback URL into the Redirect URIs field.
  6. Click Finish.
  7. Copy the Client ID and Client Secret on the provider detail page.

Step 3: Create an Application in authentik

  1. Go to Applications > Applications and click Create.
  2. Enter a name, such as "Windshift", and note the slug, such as windshift.
  3. Select the provider you created from the Provider dropdown.
  4. Click Create.

Step 4: Complete Windshift Configuration

  1. In the Windshift SSO dialog, paste the Client ID and Client Secret.
  2. Set the Issuer URL to https://auth.example.com/application/o/<app-slug>/. Replace auth.example.com with your authentik domain. Replace <app-slug> with the application slug from Step 3. Include the trailing slash.
  3. Leave Scopes as openid email profile.
  4. Set the checkboxes you need:
    • Enable provider: Makes the provider available on the login page.
    • Auto-provision: Creates accounts for new users automatically.
    • Allow password login: Lets provisioned users set a password.
    • Trust IdP email verification: Skips Windshift email verification.
  5. Click Save Changes.

Test the Connection

  1. In the Windshift SSO dialog, click Test Connection to verify the configuration.
  2. Or sign out and use Sign in with authentik on the login page.