Can anyone log in to Outline through OIDC?

[aliuq]

I've deployed a private Outline, I'm using Github as the OIDC provider, I have a question about permissions, will other people be able to access my Outline and log in via Github?

I only want a few people to be able to log in to my Outline.

[tommoor]

Anyone that can sign-in with the OIDC provider could sign-in to Outline yes. In this case you'll want to enable the security setting "Require invites" or add domains you control to "allowed domains".

[aliuq]

Thanks for the reply, I don't see an "Require invites" setting in the security settings.

outline version is v0.72.2

[aliuq]

I found "Require invites" is only avaliable for app.getoutline.*

outline/app/utils/isCloudHosted.ts

Lines 1 to 12 in 48d688c

	import env from "~/env";
	/**
	* True if the current installation is the cloud hosted version at getoutline.com
	*/
	const isCloudHosted = [
	"https://app.getoutline.com",
	"https://app.outline.dev",
	"https://app.outline.dev:3000",
	].includes(env.URL);
	export default isCloudHosted;

[tommoor]

Ah true, allowed domains is the way to go. Or you can purchase a paid license which includes this feature.

[aliuq]

Sorry, I have another question, if "example.com" is added to "allowed domains", does it mean that all email addresses logged in through OIDC must match "example.com" in order to log in correctly?

[tommoor]

That's correct, yep

[tommoor]

What restriction?

[JadenSWang]

sorry @tommoor I deleted my comment earlier, the restriction with regards to only allowing this setting on cloudHosted but I realized it's meant to be a paid restriction