Skip to main content

SSO Integrations

VaultysHub acts as an identity provider (IdP) and supports OpenID Connect and SAML2 protocols to easily connect your applications. This section contains detailed guides for configuring single sign-on (SSO) with various popular applications.

Supported Protocols​

OpenID Connect​

OpenID Connect is a modern authentication protocol based on OAuth 2.0. It is particularly suited for modern cloud applications and offers simple and secure integration.

OpenID Connect Endpoints:

  • Configuration: https://[your-instance].link.vaultys.org/api/oidc/[appid]/.well-known/openid-configuration
  • Authorization endpoint: https://[your-instance].link.vaultys.org/api/oidc/[appid]/auth
  • Token endpoint: https://[your-instance].link.vaultys.org/api/oidc/[appid]/token
  • UserInfo endpoint: https://[your-instance].link.vaultys.org/api/oidc/[appid]/userinfo
  • JWKS URI: https://[your-instance].link.vaultys.org/api/oidc/[appid]/jwks
  • Issuer: https://[your-instance].link.vaultys.org/api/oidc/[appid]

Note: Replace [your-instance] with your VaultysHub subdomain and [appid] with the application ID configured in VaultysHub.

SAML2​

SAML2 is a proven standard for single sign-on, widely used in enterprise environments.

SAML2 Metadata:

  • Entity ID: https://[your-instance].link.vaultys.org/[appid]
  • SSO URL: https://[your-instance].link.vaultys.org/api/saml2/sso/[appid]
  • IdP Metadata: https://[your-instance].link.vaultys.org/api/saml2/metadata/[appid]

Note: Single Logout from VaultysHub is not supported.

Note: Replace [your-instance] with your VaultysHub subdomain and [appid] with the application ID configured in VaultysHub.

Supported Applications​

Cloud and Collaboration Solutions​

Nextcloud​

Open-source cloud storage and collaboration platform. Configuration via the Social Login plugin for OpenID Connect.

GitLab​

Comprehensive DevOps platform supporting OpenID Connect and SAML2 for enterprise authentication.

Trello​

Project management and collaboration with SAML 2.0 via Atlassian Access (Enterprise).

Notion​

All-in-one workspace for notes and collaboration with SAML 2.0 support (Enterprise).

Monday.com​

Work management platform supporting SAML 2.0 and OpenID Connect (Enterprise).

Infrastructure and Network​

Tailscale​

Modern mesh VPN using OpenID Connect with WebFinger support for simplified configuration.

Headscale​

Open-source control server for Tailscale with OpenID Connect authentication.

Apache Guacamole​

Remote Desktop Gateway (RDP) in the browser, with VaultysHub authentication via OpenID Connect and Windows credentials never exposed.

Proxmox VE​

Open-source virtualization platform (VMs and containers), with an integrated OpenID Connect realm.

Portainer​

Management interface for Docker/Kubernetes containers with OAuth2/OpenID Connect support (Business edition only).

Monitoring and Observability​

Grafana​

Monitoring and observability solution with native OpenID Connect support.

Productivity and Communication​

Mattermost​

Open-source team messaging platform; SAML2 and OpenID Connect reserved for paid editions (Professional/Enterprise).

Rocket.Chat​

Open-source team messaging: VaultysHub login via a Custom OAuth provider, included in the free Community edition.

BlueMind​

Complete French collaborative messaging with SAML 2.0 and OpenID Connect support.

ERP and CRM​

Odoo​

Open-source ERP/CRM (Community 18/19), connected via OpenID Connect with the free auth_oidc module from OCA.

Dolibarr​

French open-source ERP/CRM, with integrated OpenID Connect module.

EspoCRM​

Lightweight open-source CRM, with integrated OpenID Connect.

Support and Asset Management​

GLPI​

French asset management and service center (GLPI 11), using OpenID Connect with the free Single Sign-On plugin.

Zammad​

Open-source support center, connected via SAML 2.0.

Security​

Vaultwarden​

Bitwarden-compatible password manager, with free OpenID Connect SSO (1.35+).

CRM and Marketing​

HubSpot​

CRM and marketing automation platform with SAML 2.0 support (Enterprise).

HR Solutions​

Lucca​

Complete French HR suite (Figgo, Pagga, Timmi) with SAML 2.0 and OpenID Connect.

General Configuration​

Before configuring a specific application, ensure you have:

  1. Created the application in VaultysHub - Follow the general SSO guide to add your application
  2. Configured the authentication type - Choose between OpenID Connect or SAML2 depending on the application
  3. Defined the redirect URLs - Configure the allowed URLs for the return after authentication
  4. Assigned users/groups - Manage who can access the application

Required Information​

For OpenID Connect​

  • Client ID: Unique identifier of the application in VaultysHub
  • Client Secret: Secret key for application authentication
  • Redirect URI: Return URL after authentication
  • Scopes: Generally openid profile email

For SAML2​

  • Entity ID: Unique identifier of the Service Provider
  • ACS URL: Assertion Consumer Service URL
  • Certificate: X.509 certificate for signing assertions
  • Attribute Mapping: Mapping between VaultysHub attributes and the application

Support and Troubleshooting​

Common Issues​

"Invalid redirect URI"

  • Ensure the redirect URL is exactly the same in VaultysHub and the application
  • Pay attention to trailing slashes and the protocol (http vs https)

"Invalid client credentials"

  • Check the Client ID and Client Secret
  • Ensure the application is enabled in VaultysHub

"User not authorized"

  • Verify that the user is assigned to the application
  • Check group permissions if applicable

Logs and Debugging​

Authentication logs are available in VaultysHub:

  • SSO Logs: Administration Section > Logs > SSO
  • User Events: User Profile > Activity

To enable detailed logs on the application side, refer to the specific documentation for each application.

Additional Resources​