Portainer

Portainer#

Let Portainer sign its users in with accounts from your Plone site, using its custom OAuth provider.

Note

Verified on 2026-09-24.

The examples use https://id.example.org as the issuer and https://portainer.example.org as Portainer.

1. Register the client#

Follow Register an OAuth client with:

Field

Value

Redirect URI

https://portainer.example.org

Grant

Authorization code

Scope

openid, profile, email

Secret

Yes. Portainer is a confidential client

Capture the client secret from the response. It is shown once.

2. Configure Portainer#

Portainer does not read a discovery document, so every endpoint is typed in.

Open Settings ‣ Authentication, choose OAuth, then the Custom provider, and fill in:

Field

Value

Client ID

The client ID from step 1

Client secret

The client secret from step 1

Authorization URL

https://id.example.org/@@oauth-authorize

Access token URL

https://id.example.org/@@oauth-token

Resource URL

https://id.example.org/@@oauth-userinfo

Redirect URL

https://portainer.example.org

Logout URL

https://id.example.org/logout

User identifier

preferred_username, or sub

Scopes

openid profile email

Auth Style

In Header

Save the settings.

Verify#

  1. Sign out of Portainer. Its login page offers Login with OAuth.

  2. Choosing it takes you to your Plone site, which asks you to approve Portainer once.

  3. You come back to Portainer signed in, as the user named by the claim in User identifier.

Known quirks#

  • User identifier: preferred_username is the Plone login name, which Portainer shows as the user name. sub, the Plone user id, never changes and is the safer choice if login names might.

  • Logout ends the Plone session only. This server has no OpenID Connect logout endpoint, so the Logout URL above signs the user out of your Plone site and does nothing else.

  • Teams: the profile scope also releases a groups claim, which Portainer's automatic team membership can read.

Contents