Connect an OIDC provider
Drawboard speaks standard OpenID Connect and nothing else. The provider is bound by configuration; no code changes, and no provider-specific roles.
What the provider needs
| Client type | A public client for the web app (default id drawboard-web), authorization code flow with PKCE (S256). |
|---|---|
| Redirect URIs | Exact matches, no wildcards: https://<host>/auth/callback and https://<host>/silent-renew.html, plus https://<host>/ as the post-logout redirect, and https://<host> as the web origin (CORS). <host> is your public URL (PUBLIC_URL with Compose, publicUrl with Helm). |
| Scopes | openid profile email groups (the default with Docker Compose). offline_access is optional and adds refresh tokens; the Helm chart includes it by default. |
| Audience | The aud of every access token must contain drawboard-api. Use one audience per environment, and never the client id of the web app (the chart refuses that). |
| Access tokens | Signed JWTs (RS256, ES256 or PS256; never none or HS*). The token header type may be JWT, at+jwt (RFC 9068, what Authelia issues) or absent. |
| Issuer | Must equal the iss of the access tokens byte for byte. |
| Claims | A user name (preferred_username) and a group list (groups) in the access token. Both names are configurable. |
| Refresh tokens | Rotation should be on. |
Redirect URIs
https://<host>/auth/callback
https://<host>/silent-renew.html
# post-logout redirect: https://<host>/
# web origin (CORS): https://<host>
The matching Helm values
oidc:
issuerUri: https://sso.example.org
audience: drawboard-api
claimUsername: preferred_username
claimGroups: groups
frontend:
oidc:
clientId: drawboard-web
scope: openid profile email groups offline_access
Only oidc.issuerUri and oidc.audience are required. Set oidc.jwkSetUri only if the backend reaches the provider under another address than the browser does. Back to the install guide.
Notes per provider
Keycloak
Add an Audience mapper to the client (included client audience equals
drawboard-api) and a Group Membership mapper with the full path switched off, for the groups claim. The issuer is https://<host>/realms/<realm>. Authelia
Set
access_token_signed_response_alg: RS256 on the client; otherwise the access tokens are opaque and every call is a 401. Make the client public with require_pkce: true and pkce_challenge_method: S256. Put the audience into the client's audience, make username and groups part of the access token, and allow CORS for the web app's origin (allowed_origins) on the token, revocation and userinfo endpoints of the client, because the browser calls them. Scopes: openid profile email groups, plus offline_access if you want refresh tokens, in which case turn refresh-token rotation on. Authentik
There are no Authentik-specific settings. Follow the table above: an OAuth2/OpenID client that is public with PKCE, signed JWT access tokens carrying the audience and the groups claim, and exact redirect URIs. The issuer is the one in your provider's discovery document.
Provider ready? Install Drawboard
Everything else is in the install guide.