Set up OpenID Connect for a server

This applies to every account on the server. For one team, use SAML instead.

1. Set STERNWAY_OIDC

Set STERNWAY_OIDC on the server to JSON (how to set variables):

{ "issuer": "https://idp.example.com/realms/main", "clientId": "sternway", "clientSecret": "…", "mode": "hybrid" }

Optional keys are publicClientId, audiences and scopes (default openid email profile).

2. Choose the mode

• hybrid allows password and SSO sign-in.
• enforced refuses password sign-in and sign-up, and recovery with a recovery kit also needs an SSO sign-in to the same account.

An existing account is linked to an SSO identity by email only when the IdP marks the email verified (email_verified: true).

Members then sign in with SSO, leaving the organization empty.