SSO Implimentation

Seafile Server
1

We’re getting ready to deploy Seafile Pro and are wanting to use logto io as a means of authentication.

Which would be a simpler integration method - OAuth2 or SAML?

2

Based on the query regarding SSO implementation with logto.io for Seafile Pro, here is an analysis of the integration methods available:

1. Comparison of Integration Methods

Seafile Pro supports both OAuth2 and SAML 2.0. For an integration with a modern identity provider like Logto, both are viable, but they differ in complexity and requirements:

  • OAuth2 (Simpler Configuration):
    • Configuration: Primarily involves adding several OAUTH_* variables to seahub_settings.py .
    • Dependencies: No additional system packages or certificates are usually required on the Seafile server.
    • Workflow: Standard authorization code flow. You define URLs for authorization, token, and user info.
  • SAML 2.0 (More Robust/Complex):
    • Configuration: Requires setting up Service Provider (SP) certificates (sp.crt, sp.key) and metadata URLs .
    • Dependencies: If using a binary deployment, you must install the xmlsec1 package (not needed for Docker) .
    • Maintenance: Certificates need to be updated periodically before they expire.

2. Implementation with Logto.io

Since Logto supports both protocols, OAuth2 is generally the simpler and recommended method for a quick deployment.

OAuth2 Integration Path

To use OAuth2 with Logto, you would configure the following in seahub_settings.py:

ENABLE_OAUTH = True
OAUTH_CLIENT_ID = "your-logto-app-id"
OAUTH_CLIENT_SECRET = "your-logto-app-secret"
OAUTH_REDIRECT_URL = 'https://your-seafile.com/oauth/callback/'
OAUTH_AUTHORIZATION_URL = 'https://your-logto-tenant.logto.app/oidc/auth'
OAUTH_TOKEN_URL = 'https://your-logto-tenant.logto.app/oidc/token'
OAUTH_USER_INFO_URL = 'https://your-logto-tenant.logto.app/oidc/me'
OAUTH_SCOPE = ["openid", "profile", "email"]
OAUTH_ATTRIBUTE_MAP = {
    "sub": (True, "uid"),
    "name": (False, "name"),
    "email": (False, "contact_email"),
}

Note: Ensure the OAUTH_REDIRECT_URL matches exactly what is registered in the Logto console.

SAML 2.0 Integration Path

If your organization’s security policy requires SAML:

  1. Generate SP Certs: Create a certs directory in your Seafile data volume and generate sp.crt/sp.key .
  2. Logto Setup: Use the Seafile metadata URL (https://your-seafile.com/saml2/metadata/) to configure Logto.
  3. Seafile Setup: Update seahub_settings.py with SAML_REMOTE_METADATA_URL (the metadata XML provided by Logto) and enable ENABLE_ADFS_LOGIN = True .

Recommendation

For most users, OAuth2 is the simpler integration method because it avoids the overhead of managing local SP certificates and is easier to debug during initial setup .