Overview
OIDC SSO protects the Dashboard and supports Authorization Code flow with
PKCE, state and nonce validation, discovery, and signed HttpOnly,
SameSite=Lax sessions.
Unlike other Pro features, an explicitly enabled SSO configuration fails
closed: startup aborts when the sso entitlement is missing or the
configuration is invalid, so an authentication boundary cannot disappear
silently.
Configure it under extensions.sso in the main GoModel YAML configuration:
PRO_SSO_* environment variables override the YAML values. The redirect URL
must end in /sso/callback (including any configured BASE_PATH), and HTTPS
is required except for loopback development URLs. By default, at least one
administrator group is required; set PRO_SSO_ALLOW_ALL_ADMINS=true only for
an intentionally unrestricted OIDC client.
SSO session revocation is process-local. Deploy SSO on exactly one active
GoModel Pro replica until a shared session or revocation store is available.
Audit and access control
Successful logins, rejected policies, and logouts are recorded as sanitized
audit events. Tokens, authorization codes, cookies, raw claims, and provider
error details are not stored.
An SSO session carries a user_path like a managed API key does, so the
group- and user-level model allowlists on the Users page
apply to requests made through it. Per-key allowed_models are a managed
API key setting and do not apply to SSO sessions.
