[GH-ISSUE #5534] [FR] Only offer available authentication methods of a self-hosted instance #2465

New issue

mirror · 2026-03-23T21:22:37Z

mirror commented

2026-03-23 21:22:37 +00:00

Originally created by @almereyda on GitHub (Jun 13, 2024).
Original GitHub issue: https://github.com/AppFlowy-IO/AppFlowy/issues/5534

Description

When configuring the gotrue container in AppFlowy-Cloud with GitLab authentication enabled, it is not surfaced to the admin interface https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/621 nor does it become available as a choice in the AppFlowy app.

Impact

Single-sign on is a contemporary means of authentication and many privacy-oriented organisations, esp. in civic society, rely on single-sign on providers that are independent from the large, commercial and proprietary platforms. The forked gotrue service already supports many authentication methods, which could be surfaced to the users.

Meanwhile the app could also autodetect which authentication methods are offered by the targeted AppFlowy-Cloud, which may help to reduce confusion and friction for some users, when trying to use an unconfigured authentication method.

Additional Context

This only applies to self-hosters of AppFlowy Cloud. Ideally the app parses the /gotrue/settings endpoint and adapts the offered login choices. In our example, we don't have Discord nor Google activated, yet their buttons show up in the app (not so in the admin interface).

Originally created by @almereyda on GitHub (Jun 13, 2024). Original GitHub issue: https://github.com/AppFlowy-IO/AppFlowy/issues/5534 ### Description When configuring the `gotrue` container in AppFlowy-Cloud with GitLab authentication enabled, it is not surfaced to the admin interface https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/621 nor does it become available as a choice in the AppFlowy app. ![image](https://github.com/AppFlowy-IO/AppFlowy/assets/1645308/a3992441-3fc7-411f-a860-bfda87883e19) ### Impact Single-sign on is a contemporary means of authentication and many privacy-oriented organisations, esp. in civic society, rely on single-sign on providers that are independent from the large, commercial and proprietary platforms. The forked gotrue service already supports many authentication methods, which could be surfaced to the users. Meanwhile the app could also autodetect which authentication methods are offered by the targeted AppFlowy-Cloud, which may help to reduce confusion and friction for some users, when trying to use an unconfigured authentication method. ### Additional Context This only applies to self-hosters of AppFlowy Cloud. Ideally the app parses the /gotrue/settings endpoint and adapts the offered login choices. In our example, we don't have Discord nor Google activated, yet their buttons show up in the app (not so in the admin interface).

mirror

2026-03-23 21:22:37 +00:00

closed this issue
added the
self-hosted

improvements

new feature
labels

mirror commented

2026-03-23 21:22:38 +00:00

@almereyda commented on GitHub (Oct 27, 2024):

Our instance now only shows configured OAuth clients (edit) when visiting the admin_frontend at https://appflowy.example.org/web/login

Also involved were https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/621 and https://github.com/AppFlowy-IO/AppFlowy-Cloud/pull/874

Keeping open until the Flutter App also supports adjusting its available authentication options.

@almereyda commented on GitHub (Oct 27, 2024): Our instance now only shows configured OAuth clients (*edit*) when visiting the `admin_frontend` at https://appflowy.example.org/web/login Also involved were https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/621 and https://github.com/AppFlowy-IO/AppFlowy-Cloud/pull/874 *Keeping open* until the Flutter App also supports adjusting its available authentication options.

mirror commented

2026-03-23 21:22:38 +00:00

@almereyda commented on GitHub (Apr 25, 2025):

@khorshuheng @annieappflowy Do you think we can prioritise this?

For many self-hosters it will only be natural to use an IdP that's not one of your preconfigured choices.

While logging in with custom OAuth already worked before with the admin interface (https://github.com/AppFlowy-IO/AppFlowy-Cloud/pull/874), the route https://appflowy.example.org/web/login ceased to exist following the availability of AppFlowy-Web.

Now I'm also not sure where this issue should live:

It clearly affects the AppFlowy-Web login.
Recent changes to the login were implemented in AppFlowy-Cloud. (AppFlowy-IO/AppFlowy-Cloud#1041)
Here we are in the main AppFlowy Flutter app.

Where would the desired changes live, somewhere inbetween all of them?

@almereyda commented on GitHub (Apr 25, 2025): @khorshuheng @annieappflowy Do you think we can prioritise this? For many self-hosters it will only be natural to use an IdP that's not one of your preconfigured choices. While logging in with custom OAuth already worked before with the admin interface (https://github.com/AppFlowy-IO/AppFlowy-Cloud/pull/874), the route https://appflowy.example.org/web/login ceased to exist following the availability of AppFlowy-Web. Now I'm also not sure where this issue should live: - It clearly affects the AppFlowy-Web login. - Recent changes to the login were implemented in AppFlowy-Cloud. (AppFlowy-IO/AppFlowy-Cloud#1041) - Here we are in the main AppFlowy Flutter app. Where would the desired changes live, somewhere inbetween all of them?

mirror commented

2026-03-23 21:22:38 +00:00

@khorshuheng commented on GitHub (Apr 25, 2025):

The admin panel still exists, it is just moved under /console .

Right now, we can actually use SAML 2.0 to open AppFlowy. For example, after configuring SAML 2.0, we can launch AppFlowy directly from Authentik.

But I think what missing here, is a button like "Single sign on", which should connect to arbitrary identity provider, as long as they support SAML 2.0. Or, a generic OIDC login.

@khorshuheng commented on GitHub (Apr 25, 2025): The admin panel still exists, it is just moved under /console . Right now, we can actually use SAML 2.0 to open AppFlowy. For example, after configuring SAML 2.0, we can launch AppFlowy directly from Authentik. But I think what missing here, is a button like "Single sign on", which should connect to arbitrary identity provider, as long as they support SAML 2.0. Or, a generic OIDC login.

mirror commented

2026-03-23 21:22:38 +00:00

@khorshuheng commented on GitHub (Apr 25, 2025):

Related issues:

https://github.com/AppFlowy-IO/AppFlowy/issues/7240 (duplicate of this issue)
https://github.com/AppFlowy-IO/AppFlowy-Web/issues/105
https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1362

@khorshuheng commented on GitHub (Apr 25, 2025): Related issues: - https://github.com/AppFlowy-IO/AppFlowy/issues/7240 (duplicate of this issue) - https://github.com/AppFlowy-IO/AppFlowy-Web/issues/105 - https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1362

mirror commented

2026-03-23 21:22:38 +00:00

@almereyda commented on GitHub (May 14, 2025):

Thank you for pushing this forward.

I can confirm that the route /console allows to login with the configured gotrue authentication methods, as expected.

If only the console and the Web app would use the same token, then we could already be authenticated towards it via GitLab when switching the route. They remain on the same domain, why cookies could be shared.

In addition, I would suggest to add a tiny commit that extends the Nginx location regexp to also include /console/ as a valid entry point, which currently errors out on file not found 404 without a page body.

Something like console(\/?) might do?

@almereyda commented on GitHub (May 14, 2025): Thank you for pushing this forward. I can confirm that the route `/console` allows to login with the configured gotrue authentication methods, as expected. If only the console and the Web app would use the same token, then we could already be authenticated towards it via GitLab when switching the route. They remain on the same domain, why cookies could be shared. In addition, I would suggest to add a tiny commit that extends the Nginx location regexp to also include `/console/` as a valid entry point, which currently errors out on file not found 404 without a page body. Something like `console(\/?)` might do?

mirror commented

2026-03-23 21:22:39 +00:00

@maggiv8 commented on GitHub (Aug 19, 2025):

Hi there,

I am also trying to hide these options in the app/web-app (i.e. not-configured/support sign-in options like Google, etc.). It works obviosuly fine for the web admin console. Is this possible somehow and if so how?

Thank you.

@maggiv8 commented on GitHub (Aug 19, 2025): Hi there, I am also trying to hide these options in the app/web-app (i.e. not-configured/support sign-in options like Google, etc.). It works obviosuly fine for the web admin console. Is this possible somehow and if so how? Thank you.

mirror commented

2026-03-23 21:22:39 +00:00

@almereyda commented on GitHub (Sep 2, 2025):

The issue

https://github.com/khorshuheng/appflowy-self-host-resources/issues/8

provides more context.

The helm chat (and the official docker compose) currently lack some of the gotrue env variables required to setup SAML 2.0. Although, we do have reports from users saying that they have succeeded in using Authentik/Okta to login to AppFlowy.

Meanwhile we're patiently standing by for more work on documentation of more

details. I could offer to open a tracking issue on https://github.com/AppFlowy-IO/AppFlowy-Docs for that.

It is to note, as said, that as a workaround we can use the /console route https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/621 https://github.com/AppFlowy-IO/AppFlowy-Cloud/pull/874. It currently allows to login to the AppFlowy-Cloud admin_frontend via a web browser and then to trigger a login intent for a local AppFlowy app (tested on Linux and Android). It still does not allow to authenticate for AppFlowy-Web on / / /web.

The tracking issue in AppFlowy-IO/AppFlowy-Web is

https://github.com/AppFlowy-IO/AppFlowy-Web/issues/105

To close, citing from https://github.com/AppFlowy-IO/AppFlowy-Web/issues/105#issuecomment-3319199033:

Eventually we will want to distinguish here between:

hiding unconfigured authentication providers and

also showing additional authentication providers.

@almereyda commented on GitHub (Sep 2, 2025): The issue - https://github.com/khorshuheng/appflowy-self-host-resources/issues/8 provides more context. > The helm chat (and the official docker compose) currently lack some of the gotrue env variables required to setup SAML 2.0. Although, we do have reports from users saying that they have succeeded in using Authentik/Okta to login to AppFlowy. Meanwhile we're patiently standing by for more work on documentation of more - https://github.com/AppFlowy-IO/AppFlowy-Web/issues/19 - https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1362 details. I could offer to open a tracking issue on https://github.com/AppFlowy-IO/AppFlowy-Docs for that. --- It is to note, as said, that as a workaround we can use the `/console` route https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/621 https://github.com/AppFlowy-IO/AppFlowy-Cloud/pull/874. It currently allows to login to the AppFlowy-Cloud `admin_frontend` via a web browser and then to trigger a login intent for a local AppFlowy app (tested on Linux and Android). It still does not allow to authenticate for AppFlowy-Web on `/` / `/web`. The tracking issue in AppFlowy-IO/AppFlowy-Web is - https://github.com/AppFlowy-IO/AppFlowy-Web/issues/105 --- To close, citing from https://github.com/AppFlowy-IO/AppFlowy-Web/issues/105#issuecomment-3319199033: > Eventually we will want to distinguish here between: > > 1. hiding unconfigured authentication providers and > 2. also showing additional authentication providers.

mirror commented

2026-03-23 21:22:39 +00:00

@almereyda commented on GitHub (Sep 22, 2025):

I am also trying to hide these options in the [app/]web-app

@maggiv8 The latest Web release supports your use case since https://github.com/AppFlowy-IO/AppFlowy-Web/issues/105#issuecomment-3319240837 https://github.com/AppFlowy-IO/AppFlowy-Web/issues/139#issuecomment-3319284627

I've also written an accompanying follow up with:

https://github.com/AppFlowy-IO/AppFlowy-Web/issues/141

@almereyda commented on GitHub (Sep 22, 2025): > I am also trying to hide these options in the [app/]web-app @maggiv8 The latest Web release supports your use case since https://github.com/AppFlowy-IO/AppFlowy-Web/issues/105#issuecomment-3319240837 https://github.com/AppFlowy-IO/AppFlowy-Web/issues/139#issuecomment-3319284627 I've also written an accompanying follow up with: - https://github.com/AppFlowy-IO/AppFlowy-Web/issues/141

mirror commented

2026-03-23 21:22:39 +00:00

@almereyda commented on GitHub (Oct 8, 2025):

#7240 also documents a case, where a user would like to hide the email login method, which was disabled in Gotrue/Supabase Auth.

@almereyda commented on GitHub (Oct 8, 2025): #7240 also documents a case, where a user would like to hide the email login method, which was disabled in Gotrue/Supabase Auth.

Sign in to join this conversation.