Repository navigation
Expand file tree
/
Copy pathplugin.json
More file actions
151 lines (151 loc) · 7.32 KB
/
Copy pathplugin.json
File metadata and controls
151 lines (151 loc) · 7.32 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
{
"id": "mattermost-oidc",
"name": "OIDC Authentication",
"description": "OpenID Connect (OIDC) authentication plugin for Mostlymatter/Mattermost. Enables SSO login via any standard OIDC provider (Keycloak, Authentik, Authelia, Dex, etc.) without requiring an Enterprise license.",
"homepage_url": "https://server.camp",
"icon_path": "assets/oidc-icon.svg",
"version": "0.6.2",
"min_server_version": "9.0.0",
"server": {
"executables": {
"linux-amd64": "server/dist/plugin-linux-amd64",
"linux-arm64": "server/dist/plugin-linux-arm64",
"darwin-amd64": "server/dist/plugin-darwin-amd64",
"darwin-arm64": "server/dist/plugin-darwin-arm64"
}
},
"webapp": {
"bundle_path": "webapp/dist/main.js"
},
"settings_schema": {
"header": "Configure OpenID Connect (OIDC) authentication for your Mattermost / Mostlymatter instance. This plugin enables SSO login via any standard OIDC-compliant provider.",
"footer": "After saving, restart Mattermost / Mostlymatter for changes to take effect. Redirect URI for your OIDC provider: <your-mattermost-url>/plugins/mattermost-oidc/oauth2/callback — Note: Mattermost's built-in MFA is bypassed by OIDC login. Enforce MFA at your OIDC provider instead.",
"settings": [
{
"key": "Enable",
"display_name": "Enable OIDC Authentication",
"type": "bool",
"help_text": "When true, users can log in via OpenID Connect.",
"default": false
},
{
"key": "IssuerURL",
"display_name": "Issuer URL",
"type": "text",
"help_text": "The OIDC Issuer URL (e.g., https://idp.example.com/realms/myrealm). The plugin will automatically discover all endpoints via the well-known OpenID configuration.",
"default": "",
"placeholder": "https://idp.example.com/realms/myrealm"
},
{
"key": "ClientID",
"display_name": "Client ID",
"type": "text",
"help_text": "The OAuth 2.0 Client ID registered with your OIDC provider.",
"default": "",
"placeholder": "your-client-id"
},
{
"key": "ClientSecret",
"display_name": "Client Secret",
"type": "text",
"help_text": "The OAuth 2.0 Client Secret registered with your OIDC provider.",
"default": "",
"placeholder": "your-client-secret",
"secret": true
},
{
"key": "Scopes",
"display_name": "Scopes",
"type": "text",
"help_text": "Space-separated list of OIDC scopes to request. Must include 'openid'. Typical: 'openid profile email'.",
"default": "openid profile email"
},
{
"key": "ButtonText",
"display_name": "Login Button Text",
"type": "text",
"help_text": "Text shown on the SSO login button.",
"default": "Log in with OIDC"
},
{
"key": "ButtonColor",
"display_name": "Login Button Color",
"type": "text",
"help_text": "Hex color code for the login button (e.g., #0058CC).",
"default": "#0058CC"
},
{
"key": "UsernameClaim",
"display_name": "Username Claim",
"type": "text",
"help_text": "The OIDC claim to use as the username. Common: 'preferred_username', 'sub', 'nickname'.",
"default": "preferred_username"
},
{
"key": "EmailClaim",
"display_name": "Email Claim",
"type": "text",
"help_text": "The OIDC claim to use as the user's email address.",
"default": "email"
},
{
"key": "FirstNameClaim",
"display_name": "First Name Claim",
"type": "text",
"help_text": "The OIDC claim to use for the user's first name.",
"default": "given_name"
},
{
"key": "LastNameClaim",
"display_name": "Last Name Claim",
"type": "text",
"help_text": "The OIDC claim to use for the user's last name.",
"default": "family_name"
},
{
"key": "PositionClaim",
"display_name": "Position Claim",
"type": "text",
"help_text": "The OIDC claim to use for the user's position / job title (e.g., 'position', 'job_title', 'jobTitle', 'title'). Leave empty to disable position syncing. When configured, this field will be updated from the OIDC provider on login.",
"default": "",
"placeholder": "position"
},
{
"key": "EmailVerifiedClaim",
"display_name": "Email Verified Claim",
"type": "text",
"help_text": "The OIDC claim that indicates whether the user's email address has been verified by the identity provider (standard: 'email_verified'). When present in the ID token or userinfo response, the value is synced to the Mattermost user's 'EmailVerified' field on every login. Leave empty to disable reading this claim. Note that, depending on the OIDC provider, you may have have to explicitly include 'email_verified' as another request claim scope above in order for it being returned.",
"default": "",
"placeholder": "email_verified"
},
{
"key": "RequireEmailVerified",
"display_name": "Require Email Verified",
"type": "bool",
"help_text": "When enabled, login is rejected unless the email verified claim is true. No account is created, linked, or given a session. Warning: many OIDC providers do not send this claim, enabling this without provider support will block all logins.",
"default": false
},
{
"key": "AutoCreateAccounts",
"display_name": "Auto-Create Accounts",
"type": "bool",
"help_text": "Automatically create accounts for users who authenticate via OIDC for the first time.",
"default": true
},
{
"key": "AutoLinkByEmail",
"display_name": "Auto-Link Existing Accounts by Email",
"type": "bool",
"help_text": "When enabled, existing accounts will be automatically linked to OIDC on first login if the email matches. Warning: this will override any existing auth provider (LDAP, SAML, etc.) for matching accounts.",
"default": false
},
{
"key": "DefaultTeam",
"display_name": "Default Team",
"type": "text",
"help_text": "Team name (slug) to add newly created users to. Leave blank to skip auto-joining.",
"default": ""
}
]
}
}