# Single Sign-On

By the end of this page nobody at home has to remember a SkyView-only password — they get in with one click using the account on your Synology NAS, their work account or their Google account.

> **ℹ️ Before you start**
>
> Only an admin can set this up. Where: **Settings → Single Sign-On** (desktop interface: Control Panel → Single Sign-On). You also need somewhere that already holds the accounts: the account service built into a Synology NAS, your company's account system, Google — this page calls that the identity provider. Once it is configured, the sign-in page gains a "Sign in with …" button, on the web and in the phone apps.

> **💡 Whatever they check, SkyView does not check again**
>
> Whatever the identity provider asks for — an SMS code, an authenticator app, a company policy — still applies, and once that is satisfied SkyView lets you in without stacking a code of its own on top. So a requirement like "the company mandates a second step" is met automatically the moment you connect this.

## 1. Start with the redirect URI

When you create the application at your identity provider, it will always ask for a "redirect URI" (some consoles call it a callback URL or a reply URL). SkyView's looks like this:

```
https://<the address you use to open SkyView>/api/auth/oidc/callback
```

The top of SkyView's settings page has already worked out the complete line from the address you are browsing right now, with a copy button next to it — **copying that one is the safest thing to do**.

- **Use the address you actually browse to** — not an address inside the container, and not `127.0.0.1`.
- **It has to match character for character** — `https` versus `http`, the port number, upper and lower case: one character out and it will not go through.
- **Two ways in means two entries** — if you use a LAN address at home and a public domain when you are out, register both at the provider (nearly all of them accept more than one).

## 2. What to fill in on the SkyView side

| Field | What it does |
| --- | --- |
| Enable single sign-on | The master switch. Turn it off and the button disappears from the sign-in page; accounts that are already linked stay linked |
| Button name | The name shown on the button, such as "Home NAS account" or "Work account". Leave it empty and it shows SSO |
| Provider address | Paste the address your provider gives you as is. A trailing `/.well-known/openid-configuration` or slash is fine; SkyView trims it. Must be https |
| Client ID | You get this after creating the application at your provider |
| Client secret | Same place. It is only ever used between the SkyView server and the provider's, and never reaches a browser or a phone |
| Create an account on first sign-in | On: somebody SkyView has never seen gets a SkyView account the first time they sign in. Off: they have to be linked by hand first, and unlinked sign-ins are refused |
| Role for new accounts | Keep this at "Viewer (read-only)". Promote the people who need admin rights afterwards, one at a time, under Users |

"Advanced" holds two more, and the defaults work with nearly every provider: leave "Requested scopes" as it is, and "Username comes from" decides which of the provider's fields becomes the SkyView username — if that field is missing or unusable, SkyView generates a name instead.

> **⚠️ Do not flip the master switch first**
>
> The order we suggest: fill in the provider address, client ID and client secret → save → then turn on "Enable single sign-on" → sign out and try it. That way a typo somewhere does not leave a button on the sign-in page that is guaranteed to fail.

> **ℹ️ The ones we have been all the way through**
>
> Synology, Authentik and Keycloak were each set up from scratch on real hardware, up to a successful sign-in. Microsoft Entra and Google follow the documented steps in their own consoles; what you put into SkyView is the same as for the others.

## 3. Synology SSO Server

The easiest route for NAS owners: nothing extra to install — a package DSM already offers can act as the identity provider, so the accounts on the NAS sign in to SkyView directly.

1. **Install the package and start the service**

   **What to do**: install **SSO Server** from Package Center, open it, and tick **OIDC** under **Service** (that is the common single sign-on standard; every console calls it by that name).

2. **Add an application**

   **What to do**: **Application → Add**, set the type to **OIDC**, name it whatever you like ("SkyView", say), and put the redirect URI from section 1 into **Redirect URI**.

3. **Copy two values back to SkyView**

   **What to do**: after saving, the list shows an **Application ID** and an **Application Secret** — those go into SkyView's "Client ID" and "Client secret".

4. **Fill in the provider address**

   **What to do**: enter `https://<the address you use for DSM>/webman/sso`, for example `https://nas.example.com:5001/webman/sso`.

> **⚠️ That DSM address has to be https with a valid certificate**
>
> If your browser opens DSM without a certificate warning, you are fine. SkyView refuses a self-signed certificate — DSM can request a free one in a couple of clicks, so do that step first.

Synology does not offer a separate username field, so SkyView uses the DSM login name as the SkyView username (whatever they are called on DSM, they are called here) and takes the display name from the email address. Leave "Username comes from" at its default.

## 4. Authentik

1. **Create a provider**

   **Where**: **Applications → Providers → Create** in the left-hand menu, then pick **OAuth2/OpenID Provider**.

2. **Fill in the parts that matter**

   **What to do**: pick the authorization flow you already have (with or without a consent screen, either is fine); set **Client type** to **Confidential**; put the redirect URI from section 1 into **Redirect URIs** (one per line if you have several); pick any certificate as the **Signing Key**.

3. **Copy the credentials**

   **What to do**: after saving, copy **Client ID** and **Client Secret** from the provider's detail page into SkyView.

4. **Create the application and set who can use it**

   **What to do**: **Applications → Create** an application bound to the provider you just made, and set who is allowed to use it while you are there.

5. **Fill in the provider address**

   **What to do**: the **OpenID Configuration Issuer** on the provider's detail page is the one, something like `https://auth.example.com/application/o/skyview/`. Paste the whole thing into SkyView's "Provider address". The trailing slash makes no difference.

## 5. Microsoft Entra ID (formerly Azure AD)

1. **Register the application**

   **Where**: the Azure portal → **Microsoft Entra ID → App registrations → New registration**. Under **Redirect URI**, choose the **Web** platform and enter the redirect URI from section 1.

2. **Collect two IDs**

   **What to do**: on the **Overview** page after registering, copy the **Application (client) ID** (→ SkyView's "Client ID") and the **Directory (tenant) ID** (you need it for the address in a moment).

3. **Create a client secret**

   **What to do**: **Certificates & secrets → New client secret**, and **copy the Value column immediately** — leave the page and it is gone for good. Paste it into SkyView's "Client secret".

4. **Fill in the provider address**

   **What to do**: enter `https://login.microsoftonline.com/<tenant ID>/v2.0`.

The username Entra hands over is usually a full email address; SkyView takes the part before the `@` and adds a number if that name is already taken. Leave **API permissions** at the defaults.

## 6. Google

> **⚠️ Google will not accept a LAN address**
>
> It only accepts a publicly resolvable domain over HTTPS, and refuses a LAN IP or plain http outright. Which means that to sign in with Google, your SkyView needs a domain and a certificate of its own first — see [Remote Access](/docs/remote-access), where the certificate can be requested from the web UI.

1. **Create the credentials**

   **Where**: Google Cloud Console → **APIs & Services → Credentials → Create credentials → OAuth client ID**, with the type set to **Web application**.

2. **Enter the redirect URI**

   **What to do**: put the redirect URI from section 1 under **Authorized redirect URIs**, then create it and collect the client ID and client secret.

3. **Fill in the provider address**

   **What to do**: enter `https://accounts.google.com`.

4. **Adjust where the username comes from**

   **What to do**: Google has no username field, so set "Username comes from" to `email`, or just leave the default and let SkyView generate one.

> **🛑 Do not let the whole world open an account on your SkyView**
>
> Who can sign in with Google is decided by Google's **OAuth consent screen**. On a personal account, leave the publishing status at **Testing** and add the people you want to the test users list — otherwise, with "Create an account on first sign-in" turned on, any Google account at all can register itself on your SkyView.

## 7. Keycloak

1. **Create a client**

   **Where**: pick your realm → **Clients → Create client**, set **Client type** to **OpenID Connect**, and choose a **Client ID** of your own (`skyview`, for instance).

2. **Make it a confidential client**

   **What to do**: on the next step turn on **Client authentication**, and tick **Standard flow** under **Authentication flow**.

3. **Enter the redirect URI**

   **What to do**: put the redirect URI from section 1 into **Valid redirect URIs**.

4. **Copy the secret and fill in the address**

   **What to do**: once it is created, copy **Client secret** from the **Credentials** tab; the provider address is `https://kc.example.com/realms/<realm name>`.

Keycloak provides a username field out of the box, so leave "Username comes from" at its default.

## 8. What happens the first time somebody signs in with it

1. **Off to the provider**

   **What to do**: click "Sign in with …" on the SkyView sign-in page, get sent to the provider, sign in the way you do there (including its own second step), and get sent back to SkyView automatically.

2. **SkyView looks for a matching account**

   **What to do**: nothing at all — SkyView looks you up by the unique user identifier the provider sends. If it finds a link, that is you, and you are in.

3. **Two ways it can go when there is no match**

   **With account creation on**: a new SkyView account is created there and then, with the role from the settings, and the external account is linked to it.
   **With account creation off**: it says this account is not linked to a SkyView user yet — either link it by hand as in the next section, or ask an admin to turn account creation on.

> **ℹ️ An account created this way has no local password**
>
> It can only get in through single sign-on. To let it sign in with a password as well, an admin sets one for it under **Users**. Remember to give newcomers their camera access there too — the default role is Viewer, and which cameras they see is still decided by that list.

## 9. Linking an external account to an existing SkyView account

This is for "I already have a SkyView admin account and I want to sign in to it with my NAS account from now on".

1. **Sign in to SkyView normally first**

   **What to do**: username and password, as usual.

2. **Find the linking card**

   **Where**: Settings → My account → Sign-in security → "Linked accounts".

3. **Click "Link … account"**

   **What to do**: you are sent to the provider to sign in once, and you come back finished.
   **How you know it worked**: the account is listed in the card, and from then on that button on the sign-in page takes you straight into this SkyView account.

One SkyView account can be linked to several provider accounts; the other way round, a provider account links to exactly one SkyView account — otherwise "who does this sign me in as" would have no definite answer. Unlinking is on the same card.

> **⚠️ An account with no password cannot be unlinked**
>
> An account created automatically never had a local password, so unlinking it would lock it out of itself. SkyView blocks that and tells you to have an admin set a password first.

## 10. The phone apps

Android and iOS both support it: fill in the server address on the sign-in screen (the dot beside it turns green) and the button appears by itself. Tapping it opens the system browser to finish signing in, then returns to the app automatically.

- **The phone's browser has to reach the same SkyView address** — when you are out of the house, that means the server address field needs your public address.
- **"Remember password" does not apply** — that option remembers a local password, and these accounts do not have one. To save the typing, stay signed in at the provider instead and the browser will remember you.

## 11. Common questions

- **It says the redirect URI does not match** — the address registered at the provider is not the one SkyView actually sent. Open the line at the top of SkyView's settings page and compare it with the provider's console character by character: scheme, port, trailing slash, upper and lower case. A LAN entrance and a public one each need their own entry.
- **It says the address does not match the identifier the service returned** — the "Provider address" is not the provider's real issuer (usually copied from the wrong page). Go back to the application details at your provider and copy the "Issuer / OpenID Configuration" value again. A trailing `/.well-known/openid-configuration` or slash makes no difference.
- **It comes back saying the sign-in did not complete** — two common causes. One is the clock on the machine running SkyView: more than about two minutes away from the provider's and it gets refused, which is easy to hit on a NAS with automatic time sync switched off. The other is a wrong client secret — generate a new one, paste it in and save; an empty field means "leave it as it is", so nothing changes unless you really do paste the new value.
- **How soon do changes take effect** — immediately. Change the provider address and SkyView drops what it had cached about the provider, so the very next click on the button goes to the new address.
- **If I turn single sign-on off, do the accounts it created stay** — yes, and so do the links; the button just stops appearing on the sign-in page. To clear them out for good, delete the accounts under Users.
- **Can I let only certain people use it** — yes, but you manage that at the provider (Authentik policies, Google's test users list, Synology user groups). The coarse switch on the SkyView side is "Create an account on first sign-in": turn it off and only the people you linked by hand can get in.

## Related guides

- [Users & Permissions](/docs/users) — giving newcomers their camera access
- [Two-Step Verification](/docs/two-factor) — SkyView's own code; you only need one of the two
- [Remote Access](/docs/remote-access) — setting up a domain and a certificate

---

Source:https://yun-kan.com/en/docs/sso