OpenID Connect¶
ThinLinc Web Access supports authentication via OpenID® Connect (OIDC), allowing users to authenticate through an external identity provider such as Microsoft Entra® ID or Keycloak®. This enables single sign-on (SSO) in Web Access and smooth authentication integration. For the native client, it is possible to configure single sign-on through Kerberos, see Kerberos authentication.
When OIDC authentication is enabled, users are redirected to the
provider for authentication. After the provider verifies the user’s
credentials, ThinLinc authorizes the user through PAM. The username must
match a valid Linux user account, and standard PAM authorization rules
apply, including account expiration, access restrictions, and other
policies configured in /etc/pam.d/.
Note
Users must exist as valid Linux accounts on the ThinLinc server. ThinLinc does not automatically create user accounts based on OIDC authentication. The provider handles authentication, while ThinLinc handles authorization and account validation through PAM.
This feature will let users to log in at a provider, but it should be noted that logging out of ThinLinc will not log the user out at the provider.
Before configuring OIDC authentication, ensure the following requirements are met:
An OIDC application can be registered at your provider
The provider has a valid TLS certificate that is trusted by the ThinLinc server
User directory integration (i.e. LDAP, IPA or Active Directory) is configured and users can be resolved (with getent for example)
