Scarriffle/Calendarr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: echte Redirect-URIs der Mobile-Clients in der SSO-Anleitung

Browse Source 
Die Platzhalter-URI calendarr://oauth/callback durch die tatsaechlichen
Reverse-DNS-Schemata der beiden Apps ersetzt und vermerkt, dass sie als
Public Clients ohne Secret laufen und ohne MOBILE_CLIENT_ID keinen
SSO-Button zeigen.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Scarriffle
2026-09-09 18:14:33 +02:00
co-authored by Claude Opus 5
parent 31baf4b18c
commit 25fde49cee
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -1
View File
@@ -135,7 +135,13 @@ Adds an SSO button to the login screen **alongside** password login. With
(the web flow uses PKCE, so a secret buys little), with two redirect URIs: (the web flow uses PKCE, so a secret buys little), with two redirect URIs:
- Web: `https://calendar.example.com/api/auth/oidc/authentik/callback` - Web: `https://calendar.example.com/api/auth/oidc/authentik/callback`
- Mobile: `calendarr://oauth/callback` - iOS: `com.scarriffleservices.calendarr.ios:/oauth2redirect`
- Android: `com.scarriffle.calendarr:/oauth2redirect`
The mobile apps are separate repositories (`Calendarr-IOS`, `Calendarr-Android`)
and authenticate as **public** clients via AppAuth — PKCE, no client secret.
Set `OIDC_<KEY>_MOBILE_CLIENT_ID` to the client id they use; without it the apps
show no SSO button.
Signing key RS256, scope mappings `openid`, `profile`, `email` — and Signing key RS256, scope mappings `openid`, `profile`, `email` — and
**`offline_access` for the mobile apps**. Since Authentik 2024.2 that scope has **`offline_access` for the mobile apps**. Since Authentik 2024.2 that scope has