Skip to main content
server.camp Docs
server.camp Docs
server.camp Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  1. Documentation
  2. /
  3. Services
  4. /
  5. HedgeDoc
  6. /
  7. Set up single sign-on (SSO)

Set up single sign-on (SSO)

Feedback on this page

You can configure your HedgeDoc so users sign in via single sign-on (SSO) against your identity provider. HedgeDoc uses generic OAuth2 with explicit endpoints (no discovery), so it works with Authentik, Keycloak, Zitadel and other OAuth2-capable providers. This guide walks through the setup using Authentik as an example (managed Authentik at server.camp).

The entire configuration is self-service in your server.camp customer portal — no support needed, on all plans. There is no separate enable switch: SSO is active as soon as the required fields are set.

Prerequisites

  • An active HedgeDoc subscription at server.camp
  • A reachable, OAuth2-capable identity provider instance (e.g. managed Authentik at server.camp)
  • Admin access to both systems

Step 1: Create a provider in Authentik

  1. In Authentik, open Applications → Providers
  2. Click “Create” → Type: OAuth2/OpenID Connect
  3. Fill in the fields:
    • Name: HedgeDoc
    • Client Type: Confidential
    • Redirect URIs: https://<your-hedgedoc-domain>/auth/oauth2/callback
    • Signing Key: Select the default key (already available)
  4. Save — Authentik automatically generates a Client ID and Client Secret. You’ll need both later in the portal.
Copy Client ID and Secret now
Open the provider you just created and copy Client ID and Client Secret into a text editor. You’ll need them shortly in the server.camp portal.

Step 2: Create an application in Authentik

  1. Go to Applications → Applications → “Create”
  2. Fill in the fields:
    • Name: HedgeDoc
    • Slug: hedgedoc
    • Provider: select the HedgeDoc provider you just created
  3. Optional: Under UI Settings, upload a HedgeDoc logo and set the launch URL to https://<your-hedgedoc-domain>
  4. Save
Restrict access by group (recommended)
Open the application → Policy / Group / User Bindings tab → “Create” → Group → select the group that should have access to HedgeDoc (e.g. all-employees). Only members of that group will be able to sign in via Authentik.

Step 3: Find the endpoints in Authentik

HedgeDoc needs the three OAuth2 endpoints explicitly (there is no automatic discovery). You’ll find them in Authentik under the provider or application. They are:

Authorization: https://<your-authentik>/application/o/authorize/
Token:         https://<your-authentik>/application/o/token/
Userinfo:      https://<your-authentik>/application/o/userinfo/

Replace <your-authentik> with your actual Authentik address. The trailing slashes are part of the URLs.

Step 4: Enter the values in the server.camp portal

In the customer portal, open the configuration of your HedgeDoc subscription and enter the following values:

Field Value
Login button display name Free to choose, e.g. Sign in with Authentik — shown as the button label
Authorization URL Authorization endpoint from Step 3
Token URL Token endpoint from Step 3
Userinfo URL Userinfo endpoint from Step 3
Client ID Copied from Authentik (Step 1)
Client Secret Copied from Authentik (Step 1)
Scopes Default openid email profile

Save and wait for the deployment to finish (approx. 1–2 minutes). SSO is active as soon as these required fields are set — there is no separate enable switch. The HedgeDoc login page then shows a button to sign in via your provider.

Optional fine-tuning

The following fields have sensible defaults and stay unchanged in most cases. Set them only if your identity provider delivers user data under different claims:

Field Default Effect
Username claim preferred_username Claim the unique username is read from
Display name claim name Claim for the user’s displayed name
Email claim email Claim for the user’s email address

Login flow for your users

  1. Open HedgeDoc in the browser
  2. On the login page, click the button for your provider (e.g. “Sign in with Authentik”)
  3. Redirect to Authentik, sign in there (and 2FA if enabled)
  4. Back in HedgeDoc — the user is signed in
Test before rolling out
Test the SSO login with a regular user account before rolling it out to the team. This confirms the redirect URI and endpoints are set correctly before everyone relies on it.

Troubleshooting

  • “Redirect URI mismatch” at the IdP: The redirect URI in Authentik doesn’t match what HedgeDoc sends. Verify the URL is stored exactly — including https:// and the path /auth/oauth2/callback.
  • No SSO button visible: Are all required fields (authorization, token, userinfo URL, client ID, client secret) set in the portal and the deployment finished?
  • Sign-in fails or username is missing: Check the scopes (openid email profile) and whether your provider’s claims match the optional fine-tuning settings (defaults preferred_username, name, email).

Questions?

If you run into issues with the SSO integration, reach out at support@server.camp.

HedgeDoc – Getting Started Mattermost