OpenID Connect Endpoints

Point OIDC/OAuth clients (e.g. Home Assistant) at the discovery URL below. It advertises the authorization, token, and userinfo endpoints automatically.

Issuer: <%= issuer %>
Discovery URL

Client ID

Redirect URIs

{{ . }}

Scopes

{{ scopes_display }}

Access

{{ #has_group_restriction }} Restricted {{ allowed_groups_display }} {{ /has_group_restriction }} {{ ^has_group_restriction }} Any user {{ /has_group_restriction }}

Access Token

Refresh Token

Created by

Everything a 3rd-party app or host needs to bind this directory, filled in for <%= ssoUrl %>.

Connection details

For a single app's own "LDAP authentication" settings — see Connecting a 3rd-party app or container for a field-by-field walkthrough (Gitea, generic Docker LDAP_* env vars, …).

LDAPS URL
Base DN
User search base
Group search base
User filter
Username attribute
Example bind DN: A read-only bind account — create one below under Service Accounts (don't reuse a real person's login or the admin DN).

Set up a Linux host (ldap-client)

For full host login, SSH keys, and sudo via LDAP (not just one app) — clone theta42/ldap-client and run this on the host. Fill in a service account's password (create one below) and, if you want this host's access/sudo groups auto-registered, an API token from your Profile.

Service Accounts

Bind-only LDAP identities for apps and hosts — not real people, can't log into this UI, no home directory. theta-env's cn=ldapclient bootstrap account (used by theta42/proxy) shows up here too, since it's the same kind of account.
Need an account something actually runs as on a Linux host instead (a media manager, a torrent client, ...) — with a real uidNumber and a group other accounts join for write access? That's a Unix account, not a bind-only one — create it from Users with This is a service account checked.

Name	Description
`cn={{cn}},<%= userBase %>`	{{description}}

Integrations

{{ name }}

Edit OAuth Client

Secret

Integrations

{{ name }}