Skip to main content
server.camp Docs
server.camp Docs
server.camp Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  1. Documentation
  2. /
  3. Services
  4. /
  5. Seafile
  6. /
  7. Set up single sign-on (SSO)

Set up single sign-on (SSO)

Feedback on this page

You can configure your Seafile instance so that users sign in via single sign-on (SSO) against your identity provider. Seafile authenticates via OAuth2/OpenID Connect against Authentik — your team signs in with their central account and doesn’t need to be created in Seafile beforehand.

Setup is self-service directly in the server.camp portal — no support ticket needed, and the feature is available on all plans.

Prerequisites

  • An active Seafile subscription at server.camp
  • A reachable Authentik instance (e.g. managed Authentik at server.camp)
  • Admin access to both systems

Step 1 – Create a provider in Authentik

  1. In Authentik, open Applications → Providers
  2. Click “Create” → Type: OAuth2/OpenID Connect
  3. Fill in the fields:
    • Name: Seafile
    • Client Type: Confidential
    • Redirect URIs / callback URI: 
      https://<your-seafile-domain>/oauth/callback/
      Note the trailing slash — the URI must be stored exactly like this.
    • Signing Key: Select the default key (already available)
  4. Save — Authentik automatically generates a Client ID and Client Secret. You’ll need both later in the portal.
Copy Client ID and secret now
Open the provider you just created and copy the Client ID and Client Secret into a text editor. You’ll need them shortly in the server.camp portal.

Step 2 – Create an application in Authentik

  1. Go to Applications → Applications → “Create”
  2. Fill in the fields:
    • Name: Seafile
    • Slug: seafile
    • Provider: select the Seafile provider you just created
  3. Optional: Under UI Settings, upload a Seafile logo and set the launch URL to https://<your-seafile-domain>
  4. Save
Restrict access by group (recommended)
Open the application → Policy / Group / User Bindings tab → “Create” → Group → select the group that should have access to Seafile (e.g. all-employees). Only members of that group will be able to sign in to Seafile via Authentik.

Step 3 – Find the endpoints

Seafile uses explicit OAuth2 endpoints (no discovery). You need three URLs from your Authentik instance. Replace <your-authentik> with your actual Authentik address:

Endpoint URL
Authorization URL https://<your-authentik>/application/o/authorize/
Token URL https://<your-authentik>/application/o/token/
Userinfo URL https://<your-authentik>/application/o/userinfo/

These endpoints are the same across your whole Authentik instance and independent of the application slug.

Step 4 – Configure Seafile in the server.camp portal

In the customer portal, open the configuration of your Seafile subscription and enter these values:

Field Value
Enable single sign-on Checked
Provider domain Allowed email domain of your users, e.g. your-company.com
Client ID From Authentik (Step 1)
Client secret From Authentik (Step 1)
Authorization URL https://<your-authentik>/application/o/authorize/
Token URL https://<your-authentik>/application/o/token/
Userinfo URL https://<your-authentik>/application/o/userinfo/
Scopes openid profile email (default)
SSO-only login Optional – hides the local email/password login (sign-in via SSO only)

Save and wait for the deployment to finish (about 1–2 minutes). The Seafile login page then shows an additional button to sign in via your provider.

Only enable "SSO-only login" after a successful test
Only enable “SSO-only login” once you can sign in via SSO — otherwise you lock yourself out. It then disables local email/password login, and sign-in runs exclusively through your identity provider.
No attribute mapping needed
Seafile uses the email address as the login. The attribute mapping (unique ID, email, and name) is handled automatically by the platform. Users do not need to be created in Seafile beforehand — their account is created on the first SSO login.

Step 5 – Test the login

  1. Open Seafile in the browser and sign out if needed
  2. The login page now shows a button to sign in via your provider
  3. Click the button — you’ll be redirected to Authentik
  4. After authentication (and 2FA if enabled), the user lands back in Seafile and is signed in
Test before switching over
The classic login form remains available next to the SSO button. This lets you sign in with your local admin account if the configuration needs adjusting.

Troubleshooting

  • “redirect_uri mismatch” at Authentik: check that the redirect URI is stored exactly — including the path (/oauth/callback/) and the trailing slash. https://<your-seafile-domain>/oauth/callback (without the slash) causes this error.
  • Login is rejected even though the credentials are correct: check that the provider domain in the portal matches your users’ email domain. For example, if max@your-company.com signs in, the provider domain must be your-company.com. If it doesn’t match, Seafile refuses the login.
  • No SSO button visible: is “Enable single sign-on” checked and has the deployment in the portal finished?

Questions?

If you run into issues with SSO, reach our support via the customer portal.

Seafile – Getting Started Snipe-IT