Skip to content

OpenID Connect

Single Sign-On

OpenID Connect (OIDC) extends OAuth 2.0 with Single Sign-On (SSO) functionality, allowing users to log in and optionally register via OIDC instead of manually entering a username and password:

oidc-login

Authentication Flow

oidc-sso-flow

Learn more ›

Config Options

Environment CLI Flag Default Description
PHOTOPRISM_OIDC_URI --oidc-uri identity provider URI for single sign-on via OpenID Connect, e.g. "https://accounts.google.com/"
PHOTOPRISM_OIDC_INSECURE --oidc-insecure skip identity provider SSL/TLS certificate verification
PHOTOPRISM_OIDC_CLIENT --oidc-client client ID for single sign-on via OpenID Connect
PHOTOPRISM_OIDC_SECRET --oidc-secret client SECRET for single sign-on via OpenID Connect
PHOTOPRISM_OIDC_PROVIDER --oidc-provider custom identity provider NAME, e.g. "Google"
PHOTOPRISM_OIDC_ICON --oidc-icon custom identity provider icon URI
PHOTOPRISM_OIDC_REGISTER --oidc-register allow new users to create an account when they sign in with OpenID Connect
PHOTOPRISM_OIDC_REDIRECT --oidc-redirect automatically redirect unauthenticated users to the configured identity provider
PHOTOPRISM_DISABLE_OIDC --disable-oidc disable single sign-on via OpenID Connect, even if an identity provider has been configured

Note that your PhotoPrism instance and the OpenID Connect Identity Provider must use HTTPS, otherwise single sign-on via OIDC cannot be enabled.

Service Discovery

Client Configuration

Single Sign-On via OpenID Connect can be configured automatically if Identity Providers offer a standardized /.well-known/openid-configuration endpoint for service discovery:

Server Endpoint

It is not yet possible to use PhotoPrism as an OIDC Identity Provider, since not all the required standards and grant types have been fully implemented. However, querying the /.well-known/openid-configuration endpoint shows what is already available, and the remaining functionality can be added over time as needed:

Software Libraries

Protocol References