Skip to main content

Single Sign On

Muninn supports multiple authentication options, from internal userbase (credentials), to LDAP (with Active directory support), and OIDC.

Auth configuration common variables​

Environment VariableDescriptionDefault Value
AUTH_PROVIDERSSelect Which provider to use between credentials, ldap and oidc.
Multiple providers can be enabled with by separating them with ,, (ex. AUTH_PROVIDERS=credentials,oidc, it is highly recommended to just enable one provider).		credentials
AUTH_LOGOUT_REDIRECT_URLURL to redirect to after clicking logging out.---
AUTH_SESSION_EXPIRY_TIMETime for the session to time out. Can be set as pure number, which will automatically be used in seconds, or followed by s, m, h or d for seconds, minutes, hours or days. (ex: "30m")"30d"
AUTH_COOKIE_PREFIXPrefix used for all authentication cookies (session, csrf, callback, pkce, state, nonce). Change this if you run another Auth.js/NextAuth app on the same hostname as Muninn (browsers scope cookies by host, not by port) to avoid cookie name collisions. Only letters, numbers, hyphens and underscores are allowed.muninn

This is the default provider.

First user is created using the onboarding process and the rest can be created by this user (see user management)

Example setups​

This example demonstrates how to use Authentik as an OIDC provider for Muninn.

User and group management is handled within Authentik. Muninn synchronizes group memberships based on OIDC claims provided by Authentik. To grant administrative privileges, create a group in Authentik (e.g., muninn-admins) and add the relevant users. Then add the group with the same name in Muninn and assign the desired permissions to it.

Example Setup

1. Configure Authentik:

  • Create an OIDC application in Authentik for Muninn.
  • Set the redirect URIs to:
    • https://<your-muninn-domain>/api/auth/callback/oidc
    • http://localhost:3000/api/auth/callback/oidc (for local development)
  • Record the client ID, client secret, and application slug.
  • Create a group (e.g., muninn-admins) and assign users who require admin access.

2. Example .env file:

OIDC_CLIENT_ID=identificationid #OIDC client ID
OIDC_CLIENT_SECRET=secretsecretsecret #OIDC client secret
OIDC_SLUG=muninn #Application slug in Authentik
AUTH_DOMAIN=auth.example.com #Authentik FQDN
ADMIN_GROUP=muninn-admins #Authentik group for Muninn admins
MUNINN_FQDN=muninn.example.com #Muninn FQDN
SECRET_ENCRYPTION_KEY=encryptencryptencrypt #Muninn encryption key

3. Example Docker Compose configuration:

services:
  muninn:
    image: ghcr.io/emkraan/muninn:latest
    container_name: muninn
    restart: unless-stopped
    ports:
      - '7575:7575'
    volumes:
      - ./muninn:/appdata
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - TZ=America/Los_Angeles
      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY}
      - BASE_URL=https://${MUNINN_FQDN}
      - NEXTAUTH_URL=https://${MUNINN_FQDN}
      - AUTH_PROVIDERS=oidc #(optional: include ',credentials' to keep local accounts as fallback)
      - AUTH_OIDC_CLIENT_ID=${OIDC_CLIENT_ID}
      - AUTH_OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
      - AUTH_OIDC_ISSUER=https://${AUTH_DOMAIN}/application/o/${OIDC_SLUG}/
      - AUTH_OIDC_URI=https://${AUTH_DOMAIN}/application/o/authorize
      - AUTH_OIDC_CLIENT_NAME=authentik
      - AUTH_OIDC_SCOPE_OVERWRITE=openid email profile groups
      - AUTH_OIDC_GROUPS_ATTRIBUTE=groups
      - AUTH_LOGOUT_REDIRECT_URL=https://${AUTH_DOMAIN}/application/o/${OIDC_SLUG}/end-session/
      - AUTH_OIDC_AUTO_LOGIN=true #To sign in with Authentik automatically
    networks:
      - my-network
networks:
  my-network:
    external: true

4. Additional Notes:

  • Ensure both Authentik and Muninn are accessible via the specified FQDNs.
  • The AUTH_OIDC_GROUPS_ATTRIBUTE should correspond to the claim in Authentik that contains group names (typically groups).
  • Your user will automatically be placed in groups that have the same name as those of authentik. So simply create them in Muninn and give them the permissions you want.
  • For further information, refer to the Authentik OIDC documentation.

Additional OIDC configuration options are described in the OIDC tab above.