SSO on SB 2.11

Troubleshooting
1

I struggled a bit with setting up SSO for the new instance. I have it working with PocketID now, but I was trying to get it integrated with Cloudflare:

  1. I tried to (re)integrate silverbullet 2.11 with Cloudflare SSO. I had it setup fairly close to the earlier guide on the forum (additionally, I use PocketID as OpenID provider for Cloudflare). However, I tried to setup Silverbullet in Cloudflare as an "SaaS application" with OIDC, but Silverbullet doesn't accept the config, telling me it needs to provide a valid e-mail address. Anyone got this to work. Would be good to create and updated version of the earlier guide on the forum. Happy to help once I figure out how to do it.

  2. Is the "Silverbullet bypass" configure still relevant with the new SSO config?

  3. Would it be possible to have a configuration option for a space (ie /notes) to automatically proceed with SSO login? I want all users (currently only myself) to use SSO, so ideally, I can skip the additional screen and click.

  4. I incidentally use Silverbullet Clipper and it uses SB_AUTH_TOKEN. Is this still applicable and does it still work? I feel this is a bit of a security gap for which there should be a better approach.

2

What do you use cloudflare for? Is it for tunnneling, firewall or the auth layer? Because if it’s just auth I’d probably skip that now and have it go directly through to SB with SSO on.

3

That's what I did for now and it works, but it's a "nice to have" to be able to integrated it :slight_smile:

4

I’d have to investigate how I can reliably obtain who you’re logged in as at the CF level. And not just for CF but then probably for other authentication proxies as well. Not sure if this is possible or easy in some sustainable way that wouldn’t require to run many deployments in l kinds of esoteric permutations…

I run pangolin as an authentication proxy, but disabled it for SilverBullet to have it handle authentication natively as well. Both pangolin and SB use pocket ID for SSO, but just through slightly different flows. Not ideal, but ok I think.

5

I agree that it is not a real issue if it doesn't work, but I don't think this setup is esoteric since we are both using a variant of it :slight_smile: In theory the CF and Pangolin should just act as identity proxies for Pocket-ID or whatever people use. Should be fairly standard.

But I'm not clear either how the flow via CF works. It should just pass through the claims from PocketID. I'll play a bit further with the setting to see if I can figure it out.

6

CF is not esoteric, but there’s also Autentik, Authelia, Pangolin and probably others. If they all offer one way to identify the user securily that’d be great. If I have to deploy 10 different setups for testing, I won’t be happy.

7

I don't use CF, but general SSO feedback for Zef. Authentik also by default doesn't perform email validation. You can create a custom user flow to valid email but it is more work than I can be bothered with. Instead I edited the default claim to return email_valid: true :upside_down_face:

8

Interesting, I might be able to do the same with CF. Thanks for the tip.