Single Sign-On (SSO)

Frona AI supports single sign-on through OpenID Connect (OIDC). This lets users log in with their existing identity provider (Google, Okta, Auth0, Keycloak, etc.).

Configuration

Set these environment variables to enable SSO:

Variable	Description
`FRONA_SSO_ISSUER_URL`	The OIDC issuer URL (e.g., `https://accounts.google.com`)
`FRONA_SSO_CLIENT_ID`	Your OIDC client ID
`FRONA_SSO_CLIENT_SECRET`	Your OIDC client secret
`FRONA_SSO_SCOPES`	Comma-separated scopes (e.g., `openid,email,profile`)

SSO flow

User clicks “Sign in with SSO” on the login page
User is redirected to the identity provider
After authenticating, the IdP redirects back to Frona
Frona validates the OIDC token and creates a session

Endpoints

Endpoint	Description
`GET /api/auth/sso`	SSO availability and configuration
`GET /api/auth/sso/authorize`	Initiates the OIDC flow
`GET /api/auth/sso/callback`	Handles the IdP callback

Account matching

When a user logs in via SSO for the first time:

FRONA_SSO_SIGNUPS_MATCH_EMAIL=true (default). If an existing account has the same email, the SSO login is linked to that account
FRONA_SSO_SIGNUPS_MATCH_EMAIL=false: a new account is created regardless

Email verification

By default, Frona only accepts verified email addresses from the IdP. If your IdP doesn’t always provide email verification status, you can set:

FRONA_SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION=true

Use this with caution. It trusts email addresses that haven’t been verified by the IdP.

Setting up with common providers

Google

Create a project in Google Cloud Console
Enable the “Google Identity” API
Create OAuth 2.0 credentials (Web application type)
Add your callback URL: https://your-domain.com/api/auth/sso/callback
Set the environment variables with your client ID and secret

Keycloak

Create a new client in your Keycloak realm
Set the client protocol to openid-connect
Set the redirect URI to https://your-domain.com/api/auth/sso/callback
Use the realm’s OIDC issuer URL (e.g., https://keycloak.example.com/realms/your-realm)