Single sign-on (OIDC)
Logging in
Section titled “Logging in”Proxploy supports logging in through an OIDC identity provider, using the PKCE flow so the login redirect chain is safe without needing a client secret exposed in the browser. The identity provider’s signed ID token is validated against its live published keys, not a cached or hardcoded copy, so a key rotation on the identity provider’s side is picked up automatically.
Configuring an OIDC provider
Section titled “Configuring an OIDC provider”An identity provider is configured through Settings, not the onboarding
wizard. You provide an issuer URL, client ID, and client secret. Proxploy
discovers the provider’s endpoints from its .well-known/openid-configuration
document, so the only three values you need to enter are those.
Once configured, a Sign in with SSO button appears on the login page. Removing the configuration hides the button and disables the OIDC flow, but existing accounts provisioned through it are unaffected: they can still log in with their password and TOTP.
New accounts
Section titled “New accounts”An identity provider login for someone without an existing Proxploy account is provisioned just-in-time: an account is created automatically from the verified identity token, rather than requiring a separate invite step first. Provisioning is deny-by-default: only identities the configured policy allows through get an account created for them; anyone else’s login is refused rather than silently granted whatever the default role happens to be.