Authentik
Create an OAuth2/OpenID provider and application in Authentik and connect it for single sign-on.
Costfluent signs your people in through Authentik over OpenID Connect. You create one OAuth2/OpenID provider with an application in Authentik, and Costfluent trusts the addresses at the domains you verify.
Before you start
- You need the Owner organization role in Costfluent, and administrator access to Authentik.
- Your Authentik server is reachable from the internet over HTTPS, so Costfluent can read its discovery document and keys.
- Your people's addresses are at a domain you can publish a DNS TXT record for.
Available on the Core, Optimize and Scale plans. Compare plans
Register the application
- In the Authentik admin interface, create an OAuth2/OpenID provider with the confidential client type.
- Add the redirect URI
https://app.costfluent.com/api/auth/sso/callbackwith strict matching. - Keep the
openid,emailandprofilescopes and an RS256 or ES256 signing key. - Create an application with a slug of your choice that uses this provider, and bind the users or groups who should sign in.
- Copy the client ID and the client secret from the provider.
Your discovery URL is https://<authentik-host>/application/o/<slug>/.well-known/openid-configuration, with the application's slug.
Send groups
Authentik's default profile scope mapping already sends a groups claim with the names of the user's groups, so there is nothing to add.
The Identity provider group you map in Costfluent is the group name as Authentik shows it.
Connect in Costfluent
- Open Settings, then Single sign-on, and connect your provider with the discovery URL, the client ID and the client secret.
- Add your email domains to the connection and verify each with its DNS TXT record.
- Map the groups to teams, then enable the connection.
Sign-in and security covers each of these steps, enforcement and break-glass Owners.
How it behaves
Costfluent reads these claims from the ID token, and from the userinfo endpoint where the ID token leaves one out:
iss, which must equal the issuer your discovery document named when you connected it,https://<authentik-host>/application/o/<slug>/.sub, as the identity Costfluent keeps.email, which must be at one of the connection's verified domains, whateveremail_verifiedsays. An address outside every verified domain is refused, and so is a sign-in without an address.name, for the name of an account Costfluent creates.groups, or another claim name you set on the connection.
Costfluent also refuses a token whose signature, audience, nonce or lifetime does not check out, and a discovery document that starts naming another issuer.