Patzer gets single sign-on: your family's chess server behind Authentik, Keycloak or Authelia

Description and use

Patzer now supports secure local OIDC SSO, removing password exposure for children and simplifying admin management via IdP groups.

Problem

Parents want a self‑hosted chess server for children without exposing them to external accounts, ads, or cloud services.

Outcome

Patzer now supports secure, local OIDC SSO, eliminating password exposure for children and simplifying admin management via IdP groups.

Workflow

• Configure OIDC by setting environment variables OIDC_ISSUER and OIDC_CLIENT_ID.
• Optionally enable SSO‑only mode with OIDC_ONLY=true to remove password login, sign‑up, and reset.
• Set OIDC_ADMIN_GROUP to map an IdP group to admin users; the group is checked on every login.
• Configure account linking with OIDC_AUTO_PROVISION and OIDC_MATCH_BY to control account creation or linking.
• Deploy Patzer with Docker: docker run -d -p 8800:8800 -v patzer-data:/app/data --name patzer ghcr.io/Sikamikaniko123/patzer:latest

Evidence

A contributor added OIDC single sign-on to Patzer (PR #72), and it's in the released Docker image.

Source

If you already run an identity provider on your homelab — Authentik, Keycloak, Authelia, Pocket ID, whatever — your chess server can sit behind it.

Source

SSO-only mode. OIDC_ONLY=true removes password login, sign-up and password reset entirely — in the UI and on the server.

Source