Portainer

Replace portainer.example.com with the URL of your Portainer instance and id.example.com with the URL of your Pocket ID instance.

Create the client in Pocket ID

1. In Pocket ID, open Administration → OIDC Clients and click Add OIDC Client.
2. Enter a name such as Portainer and add the callback URL https://portainer.example.com/.
3. Click Create and copy the Client ID and the Client secret. Under Show more details, also copy the Authorization URL, the Token URL, the Userinfo URL and the Logout URL. The client secret is only shown once.
4. On the client’s Access tab, select the groups that may sign in under Allowed User Groups, or choose All Users.

Configure Portainer

• While initially setting up OAuth in Portainer, it’s recommended to keep Hide internal authentication prompt set to Off in case you need a fallback login.
• This guide does not cover how to set up group claims in Portainer.

Tip

Make sure to enable the Automatic user provisioning option so users are auto-created in Portainer.

1. Open the Portainer web interface and navigate to Settings → Authentication.
2. Select Custom OAuth Provider.
3. Paste the Client ID from Pocket ID into the Client ID field in Portainer.
4. Paste the Client secret from Pocket ID into the Client Secret field in Portainer.
5. Paste the Authorization URL from Pocket ID into the Authorization URL field in Portainer.
6. Paste the Token URL from Pocket ID into the Access token URL field in Portainer.
7. Paste the Userinfo URL from Pocket ID into the Resource URL field in Portainer.
8. Set Redirect URL to https://portainer.example.com/.
9. Paste the Logout URL from Pocket ID into the Logout URL field in Portainer.
10. Set User identifier to preferred_username. This uses the user’s username instead of the email.
11. Set Scopes to email openid profile.
12. Set Auth Style to Auto detect.
13. Save the settings and sign in with the OAuth button to test it.