OAuth setup with Synology SSO

[JoTec2002]

Configuration Example

Prerequisits:
On your Synology NAS System you need to have the package "SSO Server" installed and complete the general configuration according to the guide from Synology. Furtermore the OIDC Service needs to be enabled. Guide to Synology SSO Server

Settings on Synology NAS:

1. Create new Application in your SSO Server
   
2. Select OIDC as SSO-Protocol
   
3. Enter your application name (can be freely chosen). Enter the correct Redirect URL. Needs to be https://<YOUR_MEALIE_URL>/login. Click finish
   
4. Click on edit for you newly created Application.
   
5. Make note of your ID & Secret
   

Settings on in your Mealie Config:

1. Go to your mealie docker-compose.yml file and add the following to environment:

#OIDC
OIDC_AUTH_ENABLED: "True"
OIDC_CONFIGURATION_URL: "<URL FROM your Synology SSO Server>" # Can be found on the Synology under SSO Server>Service>OIDC>Well-known URL
OIDC_CLIENT_ID: "<Auto generated ID from above>"
OIDC_CLIENT_SECRET: "Auto generated Secret from above "
OIDC_PROVIDER_NAME: "Synology NAS" #Can be freely chosen 
OIDC_NAME_CLAIM: "username" #needs to be set to username

2. Recreate your container and voilà, you're done

[b42n1]

I attempted to use the wildcard with /login* as described in the documentation, but it consistently resulted in an error.

[b42n1]

If you have existing accounts with the same email address, logging in through Synology will access those accounts. To switch the authentication method to only OIDC, you need to update the authentication method from Mealie to OIDC in the account settings under /admin/manage/users. After making this change, you will only be able to log into these accounts using OIDC. However, if you retain the default Mealie authentication method, both the original login credentials and OIDC will remain available.

[gregorne]

I had the issue of mealie not being able to resolve the Synology SSO domain since it was running in a container on the same host.

Adding:

extra_hosts:
- "your-domain.synology.me:192.168.X.X"

to the stack (docker compose yaml) resolved the issue

Note:

• replace your-domain.synology.me with your actual DDNS donain used by Synology SSO Server.
• replace 192.168.X.X with the local ip of your NAS

Also use proper indentation i cant get the formatting right in a comment