Patzer 推出單一登入，讓全家使用同一帳戶登入

Last week Patzer got single sign-on. If your family already runs Authentik, Keycloak, Authelia or Pocket ID, everyone in the house now logs into the chess server with the same identity they use everywhere else — no more one extra username and password to remember, and no more "I forgot my password" at the dinner table.

How it works

• Set OIDC_ISSUER, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET and the login page gets a "Sign in with …" button (you choose the label with OIDC_BUTTON_TEXT). Nothing changes until you set them — existing installs are untouched.
• OIDC_ONLY=true removes password login, sign-up and password reset entirely, in the UI and on the server. A fresh install started that way skips the setup wizard, whose password nobody could use anyway: the first SSO login creates the admin.
• OIDC_ADMIN_GROUP=patzer-admins makes members of a provider group the admins, re-checked at every login. While no admin exists, only group members can sign in — so on a fresh install the first admin is the first group member, not whoever is fastest.
• Logging out of Patzer logs you out of the provider too. That matters on a shared family computer.
• OIDC_AUTO_PROVISION=true creates an account for whoever the provider lets in; OIDC_MATCH_BY=username|email links a first SSO login to an existing account instead (email only when the provider marks it verified). Linked accounts get the provider's email if they have none, so password resets and notifications still reach them.

The flow is the standard authorization-code-with-PKCE, with state and nonce, built on openid-client. The part I care about most is the failure handling: a failed SSO login comes back to the login page with the reason in the user's language — provider unreachable, cancelled, no account, already linked, too many attempts — and the callbacks are rate-limited per IP, so Patzer can't be used to flood your identity provider.

Why a chess app needs SSO

Patzer is a family product, and the weakest link in a family app is always the account layer: nine-year-olds reset passwords, siblings share devices, and the last thing you want is a chess server that can't answer "who is this profile?". If your identity provider already knows who your family is, the chess server should just ask it.

SSO is merged to main and ships in the next release (v7.20). The full guide — every environment variable, the SSO-only setup, and an honest security section on what this protects and where its limits are — is in docs/OIDC.md in the repo.

Repo: https://github.com/SikamikanikoBG/patzer — MIT licensed, one Docker container, Stockfish plus your own LLM (Ollama or vLLM).