Auth providers

Users are grouped by auth providers, which define how they authenticate:

  • The Internal users provider, always present, authenticates users with a username and a password. It cannot be edited or deleted.

  • Any number of external providers, which delegate authentication to an identity provider (Microsoft Entra ID, Google, Okta, Authentik, Keycloak, …) through OpenID Connect (SSO).

Auth providers are managed by administrators in Settings → Authentication. Note that:

  • Disabling an auth provider prevents all its users from signing in and from using their personal access tokens, without altering them.

  • Deleting an auth provider also deletes all the users (and, for SCIM-enabled providers, the teams) it manages.

Sign-in flow

Internal users sign in with their username and password on the login page.

External users click Connect with {provider name} on the login page, authenticate on the identity provider, and are redirected back to CTFreak. What happens next depends on the provider:

  • Without SCIM provisioning, the account is created on first login, with the full name and picture provided by the identity provider, and without any role: an administrator then has to grant access, by assigning roles directly or through teams.

  • With SCIM provisioning, the account must have been provisioned beforehand by the identity provider, otherwise the login is refused. Provisioned users arrive already members of their teams: if those teams hold roles, new users get their access without any per-user action.

Adding an external auth provider

  1. Log in to the UI as an administrator
  2. Go to Settings → Authentication → New auth provider
  3. Fill in the form described below

An external auth provider can also be defined at startup, see How to set OIDC authentication provider at startup.

Provider type

Currently, CTFreak supports OpenID Connect, a standard implemented by most identity providers, including Microsoft Entra ID, Google, Okta, Authentik, Keycloak and Salesforce.

Provider configuration

  • Name: the name displayed on the login page (Connect with …)
  • Client ID and Client Secret: obtained from your identity provider
  • Discovery endpoint: the OpenID Connect discovery endpoint of your identity provider (usually ends with .well-known/openid-configuration)
  • External ID matching claim: the OIDC token claim used as the user external ID. Keep the default sub unless you enable SCIM provisioning with an identity provider that requires another claim (see SCIM provisioning). It can only be set when creating the auth provider.
  • SCIM provisioning: lets the identity provider provision users and teams itself, see SCIM provisioning. It can only be enabled when creating the auth provider.