Single sign on

1. Settings, Signing in to this GUI.
2. Choose Local accounts or single sign on, which is the mode to test from.
3. Fill in the discovery URL, client id and client secret from your provider.
4. Set the redirect address to the outside address of this GUI including any prefix. The software adds /auth/oidc/callback, and that whole address has to be registered with the provider.
5. Name the claim that holds group names, and the three groups for admin, operator and viewer.
6. Press Test the discovery URL, then sign in that way once.

Because no admin has completed a single sign on login yet, so switching now would lock everybody out. It is the only setting on that page that can leave nobody able to sign in, and it fails quietly.

Choose the middle mode, sign in through the provider once, then come back.

Name a group for each role. Highest wins, so somebody in the admin group and the viewer group is an admin. That means adding a person to the admin group works without taking them out of anything first.

Somebody in none of the three groups cannot sign in at all, which is how you take access away: remove them at the provider and they are out of every node at once.

Run this from the install directory on any node:

sudo ./auth-recovery.sh --allow-local

Local passwords come straight back. It needs a shell on the box, which is the point: the way back in must not depend on the thing that broke.