Single sign on + ldap recommendations?

[Stephan-P]

Now that I've got Sync-in running on my OMV system together with Collabora, Euro-Office and Nginx Proxy Manager, I am considering my options for a single sign on (SSO) authentication service and LDAP.

What are the recommended options for SSO AUTH with or without LDAP?

[Stephan-P]

OIDC services:

• Authelia?
• Authentik?
• Keycloak?
• PocketID?
• TinyAuth?
• VoidAuth?
• ...?

LDAP services:

• Light LDAP?
• ...?

Is LDAP of much benefit if it's just for a small set of users?

[Stephan-P]

I'm going to give VoidAuth a try.
And maybe this'll lead to another Awsome Sync-in Tutorial.

[Stephan-P]

@johaven I'm struggling getting Sync-in and VoidAuth to cooperate.

{
  "statusCode": 400,
  "message": "OIDC provider configuration error"
}

Both the Sync-in documentation as well as VoidAuth's UI suggest that the redirect URL should be of the format https://domain:port/api/auth/oidc/callback.
That is including :port.
But if this callback goes via the internet, then the default HTTPS port is 433 and anything else my router will block. So what's the deal here?
Or should the domain:port be an internal one like server-ip:3000 or the container name sync-in:3000?

So, what is domain:port in the redirect URL https://domain:port/api/auth/oidc/callback?

[Stephan-P]

What does this mean?
Sync-in logs:

sync-in  | [2026-07-07 08:09:28] ERROR (126): [AuthProviderOIDC] [initializeOIDCClient] OIDC client initialization failed: OperationProcessingError: only HTTP and HTTPS requests are allowed | req-dz
sync-in  | [2026-07-07 08:09:28] WARN (126): [HTTP] GET /api/auth/oidc/login (HTTPS/1.1 400) 88.159.160.217 (64 bytes in 4ms) Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 | req-dz
sync-in  |     err: {
sync-in  |       "type": "HttpException",
sync-in  |       "message": "OIDC provider configuration error",
sync-in  |       "stack":
sync-in  |           HttpException: OIDC provider configuration error
sync-in  |               at AuthProviderOIDC.mapOIDCInitializationError (/app/server/authentication/providers/oidc/auth-provider-oidc.service.js:235:28)
sync-in  |               at AuthProviderOIDC.initializeOIDCClient (/app/server/authentication/providers/oidc/auth-provider-oidc.service.js:219:24)
sync-in  |               at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
sync-in  |               at async AuthProviderOIDC.getConfig (/app/server/authentication/providers/oidc/auth-provider-oidc.service.js:59:27)
sync-in  |               at async AuthProviderOIDC.getAuthorizationUrl (/app/server/authentication/providers/oidc/auth-provider-oidc.service.js:65:24)
sync-in  |               at async AuthOIDCController.oidcLogin (/app/server/authentication/providers/oidc/auth-oidc.controller.js:34:21)
sync-in  |       "response": "OIDC provider configuration error",
sync-in  |       "status": 400,
sync-in  |       "name": "HttpException"
sync-in  |     }

[Stephan-P]

The maker of VoidAuth taught me that I need to take the OIDC Issuer URL and declare this in Sync-in's environment file, which I did. But it doesn't bring me much further.

{
  "statusCode": 400,
  "message": "OIDC authentication failed"
}

Sync-in docker logs (incl. Service-ID and Service-Secret :-( ):

sync-in  | [2026-07-08 21:40:08] ERROR (101): [AuthProviderOIDC] [handleCallback] OIDC callback error: HttpException: No email address found in the OIDC profile | req-1s
sync-in  | [2026-07-08 21:40:08] WARN (101): [HTTP] GET /api/auth/oidc/callback?code=jqh3BLv5jxT9Cv9HKGQkZT3U9L4b4__XSHx1RC2nan_&state=JYywMKwbKWnDEhXtqnUww2oiEknqv6apei-tsU5UGnw&iss=https%3A%2F%2Flogin.paternottes.net%2Foidc (HTTPS/1.1 400) 88.159.160.217 (57 bytes in 87ms) Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 | req-1s
sync-in  |     err: {
sync-in  |       "type": "HttpException",
sync-in  |       "message": "OIDC authentication failed",
sync-in  |       "stack":
sync-in  |           HttpException: OIDC authentication failed
sync-in  |               at AuthProviderOIDC.handleCallback (/app/server/authentication/providers/oidc/auth-provider-oidc.service.js:152:23)
sync-in  |               at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
sync-in  |               at async AuthOIDCController.oidcCallback (/app/server/authentication/providers/oidc/auth-oidc.controller.js:39:22)
sync-in  |       "response": "OIDC authentication failed",
sync-in  |       "status": 400,
sync-in  |       "name": "HttpException"
sync-in  |     }

@johaven The first line reports an error about a missing email address. Can you tell more about this? Should VoidAuth identify itself with an email address? Is there anything else you can share to help me get things working?

[Stephan-P]

If you are logged into VoidAuth, then it will immediately pass on the authenticated user info to the Client, Sync-in in this case. If the Client does not have a user account setup for this particular user, then it will issue the warning "OIDC authentication failed" or in other words "I don't know this person".
In my case, I was logged in with VoidAuth as the administrator and naturally Sync-in wouldn't want anything to do with me.

[Stephan-P]

VoidAuth OpenID Connect server and Sync-in on openmediavault 8

Openmediavault (OMV) is an open-source network attached storage (NAS) solution based on Debian Linux.
Sync-in is is a sovereign platform for file storage, sharing, synchronization, and collaboration.
VoidAuth is an open-source SSO authentication and user management provider that stands guard in front of your self-hosted applications.
Featuring OpenID Connect (OIDC), Proxy ForwardAuth, LDAP Directory Server, User and Groups Management, User Self-Registration and Invitations, Multi-factor Authentication, Passkeys, and Passkey-Only Accounts, and more, it is easy-to-use for admins and end-users.

This guide describes the steps towards installing the VoidAuth server on an openmediavault 8 system, using its Docker Compose plugin as well as Nginx Proxy Manager (NPM) to expose the private network Web services to the internet.

If Caddy or Traefik is your proxy manager of choice, then carefully study ++this section of the VoidAuth documentation++ to learn how to modify your Caddy/Traefik setup so as to co-operate with VoidAuth.

Prerequisites

• An openmediavault 8 system set up and functional, with
  • Docker Compose plugin installed
  • Nginx Proxy Manager docker container installed and functional
  • Sync-in docker container installed and functional or another OIDC-compliant Client app
• Remote access to the NAS using WinSCP

Outline of steps

1. Preparing NPM for co-operation with VoidAuth
2. Installation of VoidAuth docker using Compose
3. Initial setup of VoidAuth
4. Configuring your first OIDC Client App (Sync-in)
5. Post scriptum

---

1. Preparing NPM for co-operation with VoidAuth

Add NGINX Snippets to the NPM directory structure

• Use WinSCP to navigate to the NPM folder, i.e. /appdata/nginx-pm
• Create the subdirectory /appdata/nginx-pm/config/nginx/snippets
• In directory 'snippets' create the following files:
  • proxy.conf

  proxy_set_header Host $host;
  proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-Host $http_host;
  proxy_set_header X-Forwarded-URI $request_uri;
  proxy_set_header X-Forwarded-For $remote_addr;
  

  • websockets.conf

  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  

  • auth-location.conf

  location /api/authz/auth-request {
    internal;
  
    include /config/nginx/snippets/proxy.conf;
  
    # extra settings, don't pass the entire body to auth_request
    proxy_set_header Content-Length "";
    proxy_set_header Connection "";
    proxy_pass_request_body off;
  
    # url to send auth_request
    proxy_pass http://voidauth:3000/api/authz/auth-request;
  }
  

  • proxy-auth.conf

  auth_request /api/authz/auth-request;
  
  auth_request_set $user $upstream_http_remote_user;
  auth_request_set $groups $upstream_http_remote_groups;
  auth_request_set $name $upstream_http_remote_name;
  auth_request_set $email $upstream_http_remote_email;
  
  proxy_set_header Remote-User $user;
  proxy_set_header Remote-Groups $groups;
  proxy_set_header Remote-Name $name;
  proxy_set_header Remote-Email $email;
  
  # If response 401 or 407 code, try to redirect to Location Header as if 302.
  # NGINX auth_request cannot handle codes except 2xx and 4xx, this is a workaround
  auth_request_set $redirection_url $upstream_http_location;
  error_page 401 =302 $redirection_url;
  error_page 407 =302 $redirection_url;
  

• Make sure to change the ownership of config/nginx/snippets and its contents to 1000:100 ('appuser':'users') so that there's no barrier for NPM to access the conf files.

Modify the NPM Compose file

• Open your openmediavault workbench - Services - Compose - Files
• Edit your Nginx Proxy Manager compose file, adding an extra line to the section volumes:

      volumes:
        ...
        # nginx config code snippets folder, added for i.e. VoidAuth
        - ./config/nginx/snippets:/config/nginx/snippets
  

• Save the compose file
• Compose Check for issues followed by Compose DOWN and Compose UP
• If all is well, then NPM should function normally for all your internet exposed apps

Create a new Proxy Host for VoidAuth

• Open your Nginx Proxy Manager (NPM) instance
• Create a new Proxy Host:
  • Details:
    • Domain name: AUTH.YOUR-DOMAIN.TLD
    • Scheme: http
    • Forward hostname/IP: YOUR-SERVER-IP
    • Forward port: 3000
    • Option: Block common exploits
  • Custom locations:
    • none
  • SSL:
    • Request a new SSL Certificate: AUTH.YOUR-DOMAIN.TLD
    • Option: Force SSL
  • Custom Nginx Configuration:

    location / {
      include /config/nginx/snippets/proxy.conf;
      proxy_pass $forward_scheme://$server:$port;
    }
    

  • Save the Proxy Host configuration
  • While VoidAuth hasn't been installed yet, we cannot test the newly created Proxy Host at this point

---

1. Installation of VoidAuth docker using Compose

• Open your openmediavault workbench - Services - Compose - Networks
• Create a new Docker Bridge network called 'voidauth-net' and Save
• Open your openmediavault workbench - Services - Compose - Files
• Create a new Compose file named 'voidauth' and copy in the contents below:

services:
  db:                                        # docker prefixes this to name the sevice 'voidauth_db'
    image: postgres:18
    container_name: voidauth_db
    restart: unless-stopped
    volumes:
      - ./db:/var/lib/postgresql/18/docker
    networks:
      - voidauth-net
    environment:
      PUID: ${{ uid:"appuser" }}  # omv user
      PGID: ${{ gid:"users" }}    # omv usergroup
      POSTGRES_PASSWORD: "DB_PASSWORD"       # required, and must be the same as DB_PASSWORD in voidauth service
    healthcheck:
      test: "pg_isready -U postgres -h localhost"

  voidauth: 
    image: voidauth/voidauth:latest
    container_name: voidauth
    restart: unless-stopped
    ports:
      - 3000:3000       # may not be needed, depending on reverse-proxy setup
      # - 192.168.2.211:3000:3000
      # - '3890:3890'   # needed if LDAP Server is enabled
    volumes:
      - ./config:/app/config
      # Only required for declaring OIDC Apps via docker labels (see OIDC-Setup documentation)
      # - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - voidauth-net
      - web-proxy
    environment:
      PUID: ${{ uid:"appuser" }}  # omv user
      PGID: ${{ gid:"users" }}    # omv usergroup
      TZ: ${{ tz }}               # omv system time zone
      # Required environment variables, mostly obtained from file environment
      # See https://voidauth.app/#/Getting-Started?id=environment-variables 
      # for a list of possible environment variables
      # App settings
      APP_URL: "https://AUTH.YOUR-DOMAIN.TLD"  # required
      STORAGE_KEY: "ALPHANUMERIC_CODE1"        # required
      STORAGE_KEY_SECUNDARY: "ALPHANUMERIC_CODE2"
      SESSION_DOMAIN: 
      DEFAULT_REDIRECT: "https://AUTH.YOUR-DOMAIN.TLD"  # return to the login page if nothing else is specified
      SIGNUP: false
      SIGNUP_REQUIRES_APPROVAL: true
      EMAIL_VERIFICATION: true
      MFA_REQUIRED: false
      API_RATELIMIT: 60
      ENABLE_DEBUG: false
      # App customization
      APP_TITLE: VoidAuth
      APP_PORT: 3000
      APP_COLOR: #906bc7
      APP_FONT: monotype
      CONTACT_EMAIL: 
      #Database settings
      DB_ADAPTER: postgres
      DB_HOST: voidauth_db                   # required, and must be the same as the name of the service voidauth_db
      DB_PORT: 5432
      DB_NAME: postgres
      DB_USER: postgres
      DB_PASSWORD: "DB_PASSWORD"             # required, and must be the same as POSTGRES_PASSWORD in voidauth_db service
      DB_SSL: false
      DB_SSL_VERIFICATION: true
      # SMTP settings
      SMTP_HOST: MAIL.YOUR-DOMAIN.TLD
      SMTP_FROM: VoidAuth<no-reply@YOUR-DOMAIN.TLD>
      SMTP_PORT: 587
      SMTP_USER: USER@YOUR-DOMAIN.TLD
      SMTP_PASS: USER_PASSWORD
      SMTP_SECURE: false
      SMTP_NOAUTH: false
      SMTP_IGNORE_CERT: false
      SMTP_TLS_CIPHERS: 
      SMTP_TLS_MIN_VERSION: 
      # LDAP settings
      LDAP_ENABLED: false
      LDAP_PORT: 3890
      LDAP_BASE_DN: "cd=voidauth"
      LDAP_BIND_DN: "cn=ldap_bind,dc=voidauth"
      LDAP_BIND_PASSWORD: 
      LDAP_TLS_CERT_FILE: 
      LDAP_TLS_KEY_FILE: 
      # Misc.
      PASSWORD_STRENGTH: 3
      ADMIN_EMAILS: hourly
      DEFAULT_USER_EXPIRES_IN: 
    depends_on:
      db:
        condition: service_healthy

networks:
  voidauth-net:
    external: true
  web-proxy:
    external: true

• Modify the required variables with your own (generated) values:
  • POSTGRES_PASSWORD
  • APP_URL
  • DEFAULT_REDIRECT
  • STORAGE_KEY
  • DB_PASSWORD
  • SMTP_*
• Save the Compose file
• Compose Check for issues, Compose Pull and Compose UP
• Open the VoidAuth logs and look out for the password reset link for the initial admin user
• Copy this URL into your webbrowser to access the password reset page for the internal admin account
• Take note of the default admin username and ensure to add this to the credentials in your password manager
• Enter a new (generated) password for the internal admin account
• Also create a Passkey for easy passwordless login
• Add Multifactor Authentication (MFA) to enhance the security of your VoidAuth setup
• Logoff from VoidAuth and test both login methods

---

3. Initial setup of VoidAuth

Modify the credentials for the internal admin account

• Open your webbrowser with https://auth.your-domain.tld for the VoidAuth login page
• Enter the credentials for the internal administrator account
• Modify the Account name if you will
• Enter a valid email address (this cannot be the same email address you intend to use for a regular user account!)
  This will initiate an email verification process (and thus test the email function)
• Create a Passkey for easy, passwordless login
• Enable Multifactor Authentication for enhanced security
• Log off and login again testing the credentials with MFA, as well as the Passkey

Add a regular user account

• Login to VoidAuth using your admin credentials or passkey
• New users are not created in VoidAuth, but rather invited
• So, open Menu - Invitations and create a new invitation for user Alice (alice@domain.tld)
• An Invitation email will be sent out
• Upon accepting the invitation, the new user "Alice" will need to set a password and is advised to create a Passkey
• Note that the same user account Alice (name + email address) needs to be setup within Sync-in as well. VoidAuth and the OIDC App will exchange user information by 'name' and 'mail address'

Check the OIDC Information

• For the following steps it is necessary to take note of the OIDC Information of this particular VoidAuth setup, as these will become relevant in the configuration of OIDC Client Apps
• Open Menu - OIDC Apps
• Click "OIDC Information" to open this information section
  And take note of the following list of URLs:
  • OIDC Issuer Endpoint (a.k.a. Issuer URL)
  • Well-Known Endpoint
  • Authorization Endpoint
  • Token Endpoint
  • UserInfo Endpoint
  • Logout Endpoint
  • JWKs Endpoint

---

4. Configuring your first OIDC Client App (i.e. ync-in)

Create a new OIDC App in VoidAuth

• While still in VoidAuth - OIDC Apps, clik the button Create
• And fill out the following details:
  • Name: Sync-in
  • Home Page URL: https://sync-in.your-domain.tld
  • Logo URL: https://sync-in.your-domain.tld/assets/favicon.svg (I found this uri via the browser's developers tools)
  • Add Group: Select an applicable user group for this login
  • Take note of the Client-ID. This needs to be copied into the Sync-in environment file later on.
  • Client Secret: Click "Generate". This too needs to be copied into the Sync-in environment file later on.
  • Add a New Redirect URL: https://sync-in.your-domain.tld/api/auth/oidc/callback as this is where Sync-in will be expecting the callback
  • Response types: Code
  • Grant Types: authorization_code, refresh_token
  • PostLogout URL: empty
• Save the OIDC Client configuration
• Make sure to Logout of VoidAuth.
  As VoidAuth is a Single Sign In provider, one doesn't want to be logged in as admin, as this user will probably have no rights within Sync-in or other OIDC Client Apps.

Modify the Sync-in environment file

• Make sure that a user account Alice is well in place within Sync-in
• Use WinSCP to remote access the folder '/appdata/sync-in-docker'
• Edit the file environment.yaml

auth:
  provider: 'oidc'                                         # provider : 'mysql' | 'ldap' | 'oidc'
  ...
  oidc:
    issuerUrl: 'https://auth.your-domain.tld/oidc'         # The OIDC Issuer Endpoint URL from VoidAuth OIDC Information
    clientId: 'CLIENT-ID'                                  # The CLIENT-ID CODE from the VoidAuth OIDC App configuration
    clientSecret: 'CLIENT-SECRET'                          # The CLIENT-SECRET from the VoidAuth OIDC App configuration
    redirectUri: 'https://sync-in.your-domain.tld/api/auth/oidc/callback'  # = REDIRECT URL in VoidAuth OIDC App config
    # The following options are sensible defaults
    options:
      autoCreateUser: false                                # Do not allow auto creation of Sync-in users
      autoCreatePermissions: []
      storageQuotaClaim: storageQuota
      adminRoleOrGroup:
      enablePasswordAuth: true                             # Enable traditional login next to OpenID Connect login
      autoSyncAvatar: true                                 # Synchronise the avatar between VoidAuth and Sync-in
      autoRedirect: false
      buttonText: 'Continue with OpenID Connect'           # No need for translation here. UI language has got this covered
    # The following secutity options are sensible defaults
    security:
      scope: 'openid email profile'
      supportPKCE: false
      allowInsecureRequests: false
      tokenEndpointAuthMethod: client_secret_basic
      tokenSigningAlg: RS256
      userInfoSigningAlg: 
      skipSubjectCheck: false
      requireVerifiedEmail: false
      allowPrivateIpAvatarDownload: true

• Once saved, Docker DOWN the Sync-in container and Docker UP again

Open Sync-in via OpenID Connect

• Open your browser with https://sync-in.your-domain.tld
• Notice that the login form is showing an extra option "Continue with OpenID Connect"

• Click "Continue with OpenID Connect" to get forwarded to the VoidAuth login page
• Use the Passkey or enter the credentials of the user Alice
• Once accepted by VoidAuth, you will be automatically forwarded to Sync-in with the user account Alice
• In case you're faced with the error message:

  {
    "statusCode": 401,
    "message": "OIDC authentication failed"
  }
  

• Then you are logged into VoidAuth with an account that is unknown to Sync-in
• Go to your VoidAuth login page: https://auth.your-domain.tld to logout of VoidAuth and try to login to Sync-in with OpenID Connect again

---

5. Post scriptum

VoidAuth has now been setup and a first integration has been established with Client app Sync-in. As you will have experienced, the configuration of the interaction between this OpenID Connect Single Sign On provider and its Client is quite elaborate.

• Create an OIDC App configuration in VoidAuth
• Modify the configuration of the Client app accordingly. This can be through the file environment.yaml like with Sync-in, or environment variables within the Client's Compose file, or another configurations file, which may require direct access to the NAS using WinSCP.
• Through whatever way, the configurations of both apps will have to exchange detailed information to make the Single Sign On happen.
• VoidAuth also provides supoort for Client apps that do not comply with the OIDC standard. Detailed information about this so-called ProxyAuth method can be found in the VoidAuth documentation.

[Stephan-P]

@johaven Could you review this guide and would you like me to add it to the Awesome Sync-in tutorials?