wg-access-server

wg-access-server supports OIDC out of the box.

Create the client in Pocket ID

1. In Pocket ID, open Administration → OIDC Clients and click Add OIDC Client.
2. Enter a name such as wg-access-server and add the callback URL https://wg.example.com/callback.
3. Click Create and copy the Client ID and the Client secret. The client secret is only shown once.
4. On the client’s Access tab, select the groups that may sign in under Allowed User Groups, or choose All Users.

Configure wg-access-server

1. Open the config.yaml used by the server.
2. Create an auth section with an oidc subsection.
3. Enter the values as follows:

   auth:
     oidc:
       # Can be anything you like
       name: Pocket-ID
       # Should point to the domain you are hosting Pocket-ID on
       issuer: https://id.example.com
       # ID and Secret provided by Pocket-ID
       clientID: <client-id>
       clientSecret: <client-secret>
       # Callback URL you entered in Pocket-ID
       redirectURL: https://wg.example.com/callback
       # List of scopes to request claims for.
       # Must include at least 'openid'.
       scopes:
          - openid
          - profile
          - email
          - groups

For further reference, consult the upstream documentation.

Managing privileges

You can map groups of users that are allowed to access wg-access-server and define a group of users with admin privileges.

For example, when using LLDAP as a backend for Pocket ID, all LLDAP administrators (members of the group lldap_admin) can also be granted administrative privileges in wg-access-server with this claim mapping:

auth:
  oidc:
    # ...
    claimMapping:
      admin: "'lldap_admin' in groups"

Note that you need to enable the groups scope in the configuration.

Restricting email domains

wg-access-server can optionally restrict user access to specific email domains:

auth:
  oidc:
    # ...
    emailDomains:
      - example.com

Note that you need to enable the email scope in the configuration.