Shellius signs people in through OpenID Connect. There are presets for Google Workspace, Microsoft Entra ID, Okta and Auth0, plus Generic OIDC for any provider that publishes a discovery document.

SAML

SAML 2.0 is not available in the current setup wizard. Use OIDC.

Where the settings come from

1. Saved in the portal — Administration → Single sign-on. Saved values win.
2. Environment defaults — SSO_* variables prefill the wizard the first time. Fields backed by one show an "Environment default" badge.

# Generic OIDC
SSO_ISSUER_URL=https://idp.example.com
SSO_CLIENT_ID=...
SSO_CLIENT_SECRET=...

Presets have their own variables: SSO_GOOGLE_CLIENT_ID / _SECRET, SSO_ENTRA_TENANT_ID / _CLIENT_ID / _CLIENT_SECRET, SSO_OKTA_DOMAIN / _CLIENT_ID / _CLIENT_SECRET, and SSO_AUTH0_DOMAIN / _CLIENT_ID / _CLIENT_SECRET.

Set it up

The steps are the same for every provider:

1. In Shellius, open Administration → Single sign-on and pick your provider. The wizard shows a redirect URI of the form https://shellius.example.com/api/auth/sso/callback.

2. In your identity provider, register Shellius as a confidential web application and add that redirect URI to its allowed list.

3. Copy the client ID and client secret back into the wizard, plus the one provider-specific value:

   Provider	Also needs
   Google Workspace	Nothing else. Set the consent screen to Internal to restrict sign-in to your Workspace.
   Microsoft Entra ID	The Directory (tenant) ID. The issuer is derived as https://login.microsoftonline.com/<tenantId>/v2.0. Copy the secret's Value, not its ID.
   Okta	Your Okta domain, such as acme.okta.com. Assign the people who may use it.
   Auth0	Your Auth0 domain. Create a Regular Web Application.
   Generic OIDC	The issuer URL — the part before /.well-known/openid-configuration. Scopes are usually openid email profile.

4. Choose Test. Shellius fetches the provider's discovery document and shows the resolved issuer, scopes and authorization endpoint.

5. Save.

The issuer must be publicly resolvable

The discovery probe refuses private and loopback addresses and bare IP literals, so that a stored issuer URL cannot be used to scan your internal network. An identity provider on a private address will fail the test.

How the secret is handled

The client secret is encrypted at rest with SERVER_ENCRYPTION_KEY. The portal never receives it back — only whether one is set. Every change to the SSO configuration, and every test, writes an audit entry.

Next steps

Two-factor authenticationAdd a second factor for password sign-ins.Team and rolesDecide what people can do once they are in.Environment variablesThe rest of the configuration surface.