Data & integrations

Single sign-on (OIDC)

Name: Forge
Author: bndct-devops

Forge signs users in through any OpenID Connect provider with a discovery document — Pocket ID, Authelia, Authentik, Keycloak, Zitadel, and friends. SSO is additive: username/password keeps working, and a local admin account always remains a break-glass login the IdP can't lock out.

Reading time —

Provider setup

Callback URL: https://<your-forge-host>/api/auth/oidc/callback (must match exactly)
Grant: Authorization Code — Forge uses PKCE automatically
Scopes: openid profile email groups

Forge configuration

environment:
  - FORGE_OIDC_ENABLED=true
  - FORGE_OIDC_ISSUER=https://auth.example.com
  - FORGE_OIDC_CLIENT_ID=<from IdP>
  - FORGE_OIDC_CLIENT_SECRET=<from IdP>

Variable	Default	Purpose
`FORGE_OIDC_ENABLED`	`false`	Master switch
`FORGE_OIDC_ISSUER`	–	IdP base URL (discovery appended)
`FORGE_OIDC_CLIENT_ID` / `_CLIENT_SECRET`	–	Client credentials
`FORGE_OIDC_REDIRECT_URL`	derived	Explicit callback override behind unusual proxies
`FORGE_OIDC_SCOPES`	`openid profile email groups`
`FORGE_OIDC_GROUPS_CLAIM`	`groups`	Claim carrying group membership
`FORGE_OIDC_ADMIN_GROUP`	–	Members become Forge admins (IdP-provisioned accounts)
`FORGE_OIDC_ALLOWED_GROUP`	–	If set, required to sign in at all
`FORGE_OIDC_AUTO_CREATE`	`true`	Provision unknown IdP users automatically
`FORGE_OIDC_BUTTON_LABEL`	`Sign in with SSO`	Login-page button text