plugins.json

[
  {
    "id": "idp-oidc",
    "name": "Generic OIDC",
    "type": "idp",
    "description": "Connect any OIDC-compatible identity provider — Authentik, Ory, Okta, Auth0, Azure AD, and more.",
    "longDescription": "## Generic OIDC Identity Provider\n\nConnect Kleff to any identity provider that supports OpenID Connect.\n\n### Compatible providers\n- **Authentik** — set issuer to your application's OIDC provider URL\n- **Ory Hydra / Kratos** — set issuer to your Hydra issuer URL\n- **Okta** — set issuer to `https://your-org.okta.com/oauth2/default`\n- **Auth0** — set issuer to `https://your-tenant.auth0.com/`\n- **Azure AD** — set issuer to `https://login.microsoftonline.com/{tenant}/v2.0`\n- **Google** — set issuer to `https://accounts.google.com`\n- Any other OIDC-compliant provider\n\n### Login modes\n- **redirect** *(recommended)* — users are sent to your IDP's login page. Works with every provider.\n- **headless** — Kleff shows its own login form and forwards credentials via Resource Owner Password Credentials (ROPC). Only enable if your provider supports the ROPC grant.\n\n### User registration\nThis plugin does not create users — manage accounts through your identity provider's admin interface.\n\n### Setup\n1. Create an OIDC application / client in your identity provider.\n2. Set the redirect URI to `https://your-kleff-domain/auth/callback`.\n3. Copy the issuer URL, client ID, and client secret below.",
    "tags": [
      "oidc",
      "oauth2",
      "sso",
      "enterprise",
      "external",
      "backend",
      "identity"
    ],
    "author": "Kleff",
    "repo": "https://github.com/kleffio/plugins/idp-oidc",
    "docs": "https://docs.kleff.io/plugins/idp-oidc",
    "image": "ghcr.io/kleffio/idp-oidc",
    "version": "1.0.0",
    "minKleffVersion": "0.5.0",
    "license": "MIT",
    "verified": true,
    "capabilities": [
      "identity.provider"
    ],
    "config": [
      {
        "key": "OIDC_ISSUER",
        "label": "Issuer URL",
        "description": "Your identity provider's OIDC issuer URL. The plugin fetches configuration from {issuer}/.well-known/openid-configuration.",
        "type": "url",
        "required": true
      },
      {
        "key": "OIDC_CLIENT_ID",
        "label": "Client ID",
        "description": "The client ID of your OIDC application.",
        "type": "string",
        "required": true
      },
      {
        "key": "OIDC_CLIENT_SECRET",
        "label": "Client Secret",
        "description": "The client secret. Leave blank for public clients.",
        "type": "secret",
        "required": false,
        "advanced": true
      },
      {
        "key": "AUTH_MODE",
        "label": "Login Mode",
        "description": "redirect — users log in via your IDP's own login page (recommended). headless — Kleff shows its own form and forwards credentials via ROPC (only enable if your IDP supports it).",
        "type": "select",
        "options": [
          "redirect",
          "headless"
        ],
        "required": false,
        "default": "redirect"
      }
    ]
  },
  {
    "id": "idp-keycloak",
    "name": "Keycloak",
    "type": "idp",
    "description": "Red Hat Keycloak identity provider. SSO, MFA, and self-hosted user management.",
    "longDescription": "## Keycloak Identity Provider\n\nKleff deploys and manages a Keycloak container automatically. No configuration required.\n\n### Features\n- Bundled Keycloak container (no external setup needed)\n- SSO and MFA via Keycloak\n- User registration via Keycloak Admin REST API\n- RS256 JWT verification via JWKS endpoint\n\n### Setup\nClick Install & Activate. Kleff will start Keycloak, configure the realm, and set up an admin user automatically.",
    "tags": [
      "self-hosted",
      "sso",
      "enterprise",
      "open-source",
      "frontend",
      "backend",
      "identity"
    ],
    "author": "Kleff",
    "repo": "https://github.com/kleffio/plugins/idp-keycloak",
    "docs": "https://docs.kleff.io/plugins/idp-keycloak",
    "image": "ghcr.io/kleffio/idp-keycloak",
    "version": "0.1.4",
    "minKleffVersion": "0.5.0",
    "license": "MIT",
    "verified": true,
    "capabilities": [
      "identity.provider",
      "ui.manifest"
    ],
    "config": [
      {
        "key": "AUTH_MODE",
        "label": "Login Mode",
        "description": "redirect — users log in via Keycloak's own login page (recommended). headless — Kleff shows its own form and forwards credentials via ROPC.",
        "type": "select",
        "options": ["redirect", "headless"],
        "required": false,
        "default": "redirect"
      },
      {
        "key": "KEYCLOAK_PUBLIC_URL",
        "label": "Keycloak Public URL",
        "description": "Browser-reachable URL for Keycloak. Required for redirect login mode. Defaults to http://localhost:8180 (the port Keycloak is exposed on).",
        "type": "url",
        "required": false,
        "advanced": true,
        "default": "http://localhost:8180"
      }
    ],
    "companions": [
      {
        "id": "keycloak",
        "image": "quay.io/keycloak/keycloak:26.1",
        "command": [
          "start-dev"
        ],
        "env": {
          "KC_BOOTSTRAP_ADMIN_USERNAME": "admin",
          "KC_BOOTSTRAP_ADMIN_PASSWORD": "admin",
          "KC_HTTP_PORT": "8080"
        },
        "ports": [
          { "container": 8080, "host": 8180 }
        ],
        "volumes": [
          {
            "name": "kleff-keycloak-data",
            "target": "/opt/keycloak/data"
          }
        ],
        "skipIfEnv": "KEYCLOAK_URL",
        "internalAddr": "http://keycloak:8080"
      }
    ]
  }
]