SAML and proxy authentication

Neither is available yet. For applications that need single sign-on, use OpenID Connect; for applications that only speak LDAP, use the built-in LDAP server.

SAML

pykrete does not act as a SAML identity provider yet: there are no SAML endpoints and no metadata to import into a service provider.

If an application only supports SAML, put a SAML-to-OIDC bridge in front of it and register the bridge as an ordinary OIDC client. Configure the bridge with the issuer https://auth.infra.delta.rocks/.

Proxy / forward authentication

Forward authentication for reverse proxies (nginx auth_request, Traefik forwardAuth, Envoy ext_authz) is not available yet. Don't point a proxy at /proxy-auth.

To protect applications without their own login, use an OIDC-aware reverse proxy or authentication middleware, registered in pykrete as a normal confidential client (see OpenID Connect) and configured with the issuer https://auth.infra.delta.rocks/. The proxy handles the sign-in redirect and passes the user on from the ID token or userinfo claims.