"
Hi everyone,
I've built an independent open-source plugin that adds OpenID Connect sign-in to the OPNsense WebGUI. It has now entered public beta.
Three user-facing highlights:
- Unknown identities can enter an approval queue, where an administrator links them to an existing or new local account. The permanent binding uses the provider's exact issuer and stable subject identifier—not an email address or username—so ordinary changes such as a new surname or email address do not silently change the account association.
- You decide how much to trust the identity provider. Keep explicit administrator approval, automatically match existing users, or allow account creation on first login for a suitably controlled provider population.
- Authorization can remain entirely local, or selected local groups can be managed from an IdP group claim. Full group delegation is also possible, but requires an explicit choice.
The normal OPNsense password login remains available as a recovery path.
I built this for a single LAN-only firewall in my homelab, not for customers or as a commercial product. Development is heavily AI-assisted and backed by extensive automated tests, including generated browser screenshots. My capacity for feature requests will be limited.
I am primarily looking for help confirming real-world IdP compatibility and for independent review of the implementation, specifications and security assumptions. Automated tests are useful evidence, but not a substitute for expert review or a formal security audit.
Project and installation instructions:
https://github.com/jpawlowski/opnsense-openid-connect
Test reports, technical reviews and contributions would be very welcome.
I've built an independent open-source plugin that adds OpenID Connect sign-in to the OPNsense WebGUI. It has now entered public beta.
Three user-facing highlights:
- Unknown identities can enter an approval queue, where an administrator links them to an existing or new local account. The permanent binding uses the provider's exact issuer and stable subject identifier—not an email address or username—so ordinary changes such as a new surname or email address do not silently change the account association.
- You decide how much to trust the identity provider. Keep explicit administrator approval, automatically match existing users, or allow account creation on first login for a suitably controlled provider population.
- Authorization can remain entirely local, or selected local groups can be managed from an IdP group claim. Full group delegation is also possible, but requires an explicit choice.
The normal OPNsense password login remains available as a recovery path.
I built this for a single LAN-only firewall in my homelab, not for customers or as a commercial product. Development is heavily AI-assisted and backed by extensive automated tests, including generated browser screenshots. My capacity for feature requests will be limited.
I am primarily looking for help confirming real-world IdP compatibility and for independent review of the implementation, specifications and security assumptions. Automated tests are useful evidence, but not a substitute for expert review or a formal security audit.
Project and installation instructions:
https://github.com/jpawlowski/opnsense-openid-connect
Test reports, technical reviews and contributions would be very welcome.
