plugins.local.json

[
  {
    "id": "idp-oidc",
    "name": "Generic OIDC",
    "type": "idp",
    "description": "Connect any OIDC-compatible identity provider — Authentik, Ory, Okta, Auth0, Azure AD, and more.",
    "longDescription": "## Generic OIDC Identity Provider\n\nConnect Kleff to any identity provider that supports OpenID Connect.\n\n### Compatible providers\n- **Authentik** — set issuer to your application's OIDC provider URL\n- **Ory Hydra / Kratos** — set issuer to your Hydra issuer URL\n- **Okta** — set issuer to `https://your-org.okta.com/oauth2/default`\n- **Auth0** — set issuer to `https://your-tenant.auth0.com/`\n- **Azure AD** — set issuer to `https://login.microsoftonline.com/{tenant}/v2.0`\n- **Google** — set issuer to `https://accounts.google.com`\n- Any other OIDC-compliant provider\n\n### Login modes\n- **redirect** *(recommended)* — users are sent to your IDP's login page. Works with every provider.\n- **headless** — Kleff shows its own login form and forwards credentials via Resource Owner Password Credentials (ROPC). Only enable if your provider supports the ROPC grant.\n\n### User registration\nThis plugin does not create users — manage accounts through your identity provider's admin interface.\n\n### Setup\n1. Create an OIDC application / client in your identity provider.\n2. Set the redirect URI to `https://your-kleff-domain/auth/callback`.\n3. Copy the issuer URL, client ID, and client secret below.",
    "tags": [
      "oidc",
      "oauth2",
      "sso",
      "enterprise",
      "external",
      "backend",
      "identity"
    ],
    "author": "Kleff",
    "repo": "https://github.com/kleffio/plugins/idp-oidc",
    "docs": "https://docs.kleff.io/plugins/idp-oidc",
    "image": "ghcr.io/kleffio/idp-oidc",
    "version": "local",
    "minKleffVersion": "0.5.0",
    "license": "MIT",
    "verified": true,
    "capabilities": [
      "identity.provider"
    ],
    "config": [
      {
        "key": "OIDC_ISSUER",
        "label": "Issuer URL",
        "description": "Your identity provider's OIDC issuer URL. The plugin fetches configuration from {issuer}/.well-known/openid-configuration. If your provider runs on the same host, use host.docker.internal instead of localhost (e.g. http://host.docker.internal:8181/realms/kleff).",
        "type": "url",
        "required": true
      },
      {
        "key": "OIDC_CLIENT_ID",
        "label": "Client ID",
        "description": "The client ID of your OIDC application.",
        "type": "string",
        "required": true
      },
      {
        "key": "OIDC_CLIENT_SECRET",
        "label": "Client Secret",
        "description": "The client secret. Leave blank for public clients.",
        "type": "secret",
        "required": false,
        "advanced": true
      },
      {
        "key": "AUTH_MODE",
        "label": "Login Mode",
        "description": "redirect — users log in via your IDP's own login page (recommended). headless — Kleff shows its own form and forwards credentials via ROPC (only enable if your IDP supports it).",
        "type": "select",
        "options": [
          "headless",
          "redirect"
        ],
        "required": false,
        "default": "headless"
      }
    ]
  },
  {
    "id": "idp-keycloak",
    "name": "Keycloak",
    "type": "idp",
    "description": "Red Hat Keycloak identity provider. SSO, MFA, and self-hosted user management.",
    "longDescription": "## Keycloak Identity Provider\n\nKleff deploys and manages a Keycloak container automatically. No configuration required.\n\n### Features\n- Bundled Keycloak container (no external setup needed)\n- SSO and MFA via Keycloak\n- User registration via Keycloak Admin REST API\n- RS256 JWT verification via JWKS endpoint\n\n### Setup\nClick Install & Activate. Kleff will start Keycloak, configure the realm, and set up an admin user automatically.",
    "tags": [
      "self-hosted",
      "sso",
      "enterprise",
      "open-source",
      "frontend",
      "backend",
      "identity"
    ],
    "author": "Kleff",
    "repo": "https://github.com/kleffio/plugins/idp-keycloak",
    "docs": "https://docs.kleff.io/plugins/idp-keycloak",
    "image": "ghcr.io/kleffio/idp-keycloak",
    "version": "0.1.4",
    "minKleffVersion": "0.5.0",
    "license": "MIT",
    "verified": true,
    "capabilities": [
      "identity.provider",
      "ui.manifest"
    ],
    "config": [
      {
        "key": "AUTH_MODE",
        "label": "Login Mode",
        "description": "redirect — users log in via Keycloak's own login page (recommended). headless — Kleff shows its own form and forwards credentials via ROPC.",
        "type": "select",
        "options": ["headless", "redirect"],
        "required": false,
        "default": "headless"
      },
      {
        "key": "KEYCLOAK_PUBLIC_URL",
        "label": "Keycloak Public URL",
        "description": "Browser-reachable URL for Keycloak. Required for redirect login mode. Defaults to http://localhost:8180 (the port Keycloak is exposed on).",
        "type": "url",
        "required": false,
        "advanced": true,
        "default": "http://localhost:8180"
      }
    ],
    "companions": [
      {
        "id": "keycloak",
        "image": "quay.io/keycloak/keycloak:26.1",
        "command": [
          "start-dev"
        ],
        "env": {
          "KC_BOOTSTRAP_ADMIN_USERNAME": "admin",
          "KC_BOOTSTRAP_ADMIN_PASSWORD": "admin",
          "KC_HTTP_PORT": "8080"
        },
        "ports": [
          { "container": 8080, "host": 8180 }
        ],
        "volumes": [
          {
            "name": "kleff-keycloak-data",
            "target": "/opt/keycloak/data"
          }
        ],
        "skipIfEnv": "KEYCLOAK_URL",
        "internalAddr": "http://keycloak:8080"
      }
    ]
  },
  {
    "id": "idp-authentik",
    "name": "Authentik",
    "type": "idp",
    "description": "Authentik identity provider. Self-hosted SSO, MFA, and user management with a modern UI.",
    "longDescription": "## Authentik Identity Provider\n\nKleff deploys and manages an Authentik stack automatically (server, worker, PostgreSQL, Redis).\n\n### Features\n- Bundled Authentik container stack — no external setup needed\n- OIDC application created automatically on first start\n- SSO and MFA via Authentik flows\n- User management via Authentik admin UI (accessible from the Identity Provider settings page)\n- RS256/ES256 JWT verification via JWKS endpoint\n- Headless login: Kleff shows its own login form and authenticates via Authentik's flow executor API\n\n### Setup\n1. Click Activate. Kleff will start Authentik and configure everything automatically.\n2. Log in with `admin@localhost` / `admin`. Change your password in the Authentik admin UI.",
    "tags": [
      "self-hosted",
      "sso",
      "mfa",
      "enterprise",
      "open-source",
      "identity"
    ],
    "author": "Kleff",
    "repo": "https://github.com/kleffio/plugins/idp-authentik",
    "docs": "https://docs.kleff.io/plugins/idp-authentik",
    "image": "ghcr.io/kleffio/idp-authentik",
    "version": "local",
    "minKleffVersion": "0.5.0",
    "license": "MIT",
    "verified": true,
    "capabilities": [
      "identity.provider",
      "ui.manifest"
    ],
    "config": [
      {
        "key": "AUTHENTIK_PUBLIC_URL",
        "label": "Authentik Public URL",
        "description": "Browser-reachable URL for Authentik. Used for redirect login mode and the admin UI link. Defaults to http://localhost:9000.",
        "type": "url",
        "required": false,
        "advanced": true,
        "default": "http://localhost:9000"
      },
      {
        "key": "AUTHENTIK_BOOTSTRAP_TOKEN",
        "label": "Bootstrap Token",
        "description": "Internal token used by the plugin to authenticate against Authentik during initial setup. Must match the AUTHENTIK_BOOTSTRAP_TOKEN set on the Authentik containers.",
        "type": "secret",
        "required": false,
        "advanced": true,
        "default": "kleff-authentik-bootstrap"
      }
    ],
    "companions": [
      {
        "id": "authentik-redis",
        "image": "redis:7-alpine",
        "command": ["--save", "60", "1", "--loglevel", "warning"],
        "env": {},
        "ports": [],
        "volumes": [
          { "name": "kleff-authentik-redis", "target": "/data" }
        ],
        "skipIfEnv": "AUTHENTIK_URL"
      },
      {
        "id": "authentik-postgres",
        "image": "postgres:16-alpine",
        "env": {
          "POSTGRES_USER": "authentik",
          "POSTGRES_PASSWORD": "authentik",
          "POSTGRES_DB": "authentik"
        },
        "ports": [],
        "volumes": [
          { "name": "kleff-authentik-postgres", "target": "/var/lib/postgresql/data" }
        ],
        "skipIfEnv": "AUTHENTIK_URL"
      },
      {
        "id": "authentik-server",
        "image": "ghcr.io/goauthentik/server:2025.2",
        "command": ["server"],
        "env": {
          "AUTHENTIK_REDIS__HOST": "authentik-redis",
          "AUTHENTIK_POSTGRESQL__HOST": "authentik-postgres",
          "AUTHENTIK_POSTGRESQL__USER": "authentik",
          "AUTHENTIK_POSTGRESQL__PASSWORD": "authentik",
          "AUTHENTIK_POSTGRESQL__NAME": "authentik",
          "AUTHENTIK_SECRET_KEY": "kleff-authentik-secret-change-me",
          "AUTHENTIK_ERROR_REPORTING__ENABLED": "false",
          "AUTHENTIK_BOOTSTRAP_TOKEN": "kleff-authentik-bootstrap",
          "AUTHENTIK_BOOTSTRAP_EMAIL": "admin@localhost",
          "AUTHENTIK_BOOTSTRAP_PASSWORD": "admin"
        },
        "ports": [
          { "container": 9000, "host": 9000 },
          { "container": 9443, "host": 9443 }
        ],
        "volumes": [
          { "name": "kleff-authentik-media", "target": "/media" },
          { "name": "kleff-authentik-templates", "target": "/templates" }
        ],
        "skipIfEnv": "AUTHENTIK_URL",
        "internalAddr": "http://authentik-server:9000"
      },
      {
        "id": "authentik-worker",
        "image": "ghcr.io/goauthentik/server:2025.2",
        "command": ["worker"],
        "env": {
          "AUTHENTIK_REDIS__HOST": "authentik-redis",
          "AUTHENTIK_POSTGRESQL__HOST": "authentik-postgres",
          "AUTHENTIK_POSTGRESQL__USER": "authentik",
          "AUTHENTIK_POSTGRESQL__PASSWORD": "authentik",
          "AUTHENTIK_POSTGRESQL__NAME": "authentik",
          "AUTHENTIK_SECRET_KEY": "kleff-authentik-secret-change-me",
          "AUTHENTIK_ERROR_REPORTING__ENABLED": "false",
          "AUTHENTIK_BOOTSTRAP_TOKEN": "kleff-authentik-bootstrap",
          "AUTHENTIK_BOOTSTRAP_EMAIL": "admin@localhost",
          "AUTHENTIK_BOOTSTRAP_PASSWORD": "admin"
        },
        "ports": [],
        "volumes": [
          { "name": "kleff-authentik-media", "target": "/media" }
        ],
        "skipIfEnv": "AUTHENTIK_URL"
      }
    ]
  }
]