Single sign-on sounds simple until Authentik, Pangolin, app callback URLs, headers, secrets, internal routes, and public routes all need to agree on reality.
Original work date
June
The problem
The goal was simple: use SSO for self-hosted apps exposed through the homelab routing stack. The reality was not simple.
The environment
- App: Authentik, Pangolin, various self-hosted apps
- Host:
- Cluster / namespace:
- Version:
- Relevant config: OIDC callback URLs, proxy auth headers
What failed
Some apps supported OIDC cleanly. Some needed proxy auth. Some cared deeply about callback URLs. Some needed internal SSL validation disabled. Some broke when provider secrets changed. Authentik provider edits could regenerate client secrets, which meant app environment variables and restarts had to stay in sync.
The fix
The actual work was not “turn on OIDC.” It was making the browser, app, proxy, identity provider, internal route, public route, and secrets all agree on the same story.
Final state
What I learned
OIDC works great once every tiny little liar in the chain agrees on reality.
Useful commands / config
paste commands here