- JavaScript 94.4%
- HTML 3.9%
- CSS 1.7%
|
|
||
|---|---|---|
| docs | ||
| examples | ||
| scripts | ||
| src | ||
| test | ||
| .gitignore | ||
| CHANGELOG.md | ||
| compatibility.json | ||
| NOTICE | ||
| npm-shrinkwrap.json | ||
| package.json | ||
| README.md | ||
n8n OIDC Bridge
Add OpenID Connect sign-in to existing accounts in self-hosted n8n, with explicit account linking, native n8n sessions and provider management inside Settings → OIDC Bridge. Native password login remains available.
v0.1.0 experimental release. The adapter currently accepts exactly n8n 2.39.6, with Node 22.22 or newer, on a single main process (v0.1.0 as released accepted only 2.27.4). Authelia passed a scoped real-provider flow on 2.27.4; on 2.39.6 only the synthetic packaged-n8n suite has run so far. Keycloak and ZITADEL are integration targets, not yet qualified. Read compatibility and limitations before installing. This is not an official n8n extension or a Community Node. See release notes and distribution requirements.
What it does
- One sign-in button per enabled, available provider, with configurable text and bundled Authelia, Keycloak, ZITADEL or generic icons.
- Generic OIDC authorization-code flow with PKCE, signed ID-token validation and required, explicitly configured MFA evidence.
- Deliberate linking of an IdP identity to the currently authenticated native account. No email-based account merging, automatic signup or role changes.
- Owner-only settings: save a draft, test the full IdP roundtrip, then enable it. Edits do not replace the live configuration until tested and applied.
- UI-managed encrypted client secrets, or file-managed configuration for declarative deployment. No Nix dependency.
It does not provide SAML, SCIM, single logout, refresh-token storage, automatic user provisioning, group/role synchronization, or multi-main coordination. Disabling an IdP stops new bridge logins, not native sessions already issued.
Start here
- Download v0.1.0 and install the package using its npm tarball and the existing n8n service or container. Community Nodes cannot load this hook.
- Choose UI-managed or file-managed configuration.
- Register a confidential client at your IdP, then save, test and enable the provider.
- Have each existing user link their account once.
- Complete the acceptance checks, including native password fallback, before relying on SSO.
Source and release downloads are public on Forgejo. The original bridge code is
still UNLICENSED: public visibility is not an open-source license or a grant
of reuse rights. private: true prevents accidental npm-registry publication;
it does not prevent installing the release tarball. There is no npm-registry
release to install by name. See components and provenance.
Documentation
| I want to… | Read |
|---|---|
| Install with npm, systemd, containers or Nix | Installation |
| Understand every configuration field | Configuration reference |
| Connect Authelia, Keycloak, ZITADEL or another IdP | Provider setup |
| Add a provider, change its button or use the toggle | Provider administration |
| Link an account and understand the password prompts | User guide |
| Automate settings | Settings API and its current limits |
| Back up, upgrade, disable or recover the bridge | Operations |
| Diagnose a missing button or failed login | Troubleshooting |
| Understand implementation and development lessons | Architecture, lessons learned |
| Verify compatibility or contribute tests | Compatibility, testing |
Full documentation index includes a sanitized validation summary. Internal development records are retained locally but excluded from the package. The documentation baseline is 2026-09-27; dated reports are observations of particular artifacts, not live status monitors.