Taiga OIDC
You set up taiga oidc by linking your identity provider to the Taiga backend and frontend apps. This setup lets your team log in with existing work accounts instead of local passwords. Most teams use an open source plugin to handle the login redirect and token exchange. Still, broad admin roles in the app or database still leave backend systems exposed. How taiga oidc works in your setup Taiga splits its architecture into a frontend web app and a backend API service. When you enable taiga oid
K8s OIDC Authentication: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up taiga oidc by linking your identity provider to the Taiga backend and frontend apps. This setup lets your team log in with existing work accounts instead of local passwords. Most teams use an open source plugin to handle the login redirect and token exchange. Still, broad admin roles in the app or database still leave backend systems exposed.
How taiga oidc works in your setup
Taiga splits its architecture into a frontend web app and a backend API service. When you enable taiga oidc, both parts must know about your identity provider. A user clicks the single sign-on button on the login screen to start. The frontend sends the user to the identity provider to check their identity.
After the user logs in, the identity provider sends an authorization code back. The Taiga backend trades this code for an identity token and user profile details. It reads the email and name claims from the token to match the user. If the user does not exist yet, the backend creates a new account right away. Then Taiga issues its own session token so the user can view their projects.
Admins store the client ID and secret in the backend settings file. They also set the redirect URL in the identity provider dashboard so the callback works. You must keep the client secret safe on the server at all times. If someone steals that key, they can fake login requests to your app.
Why single sign-on is only the first step
Setting up single sign-on fixes the problem of scattered local passwords across your team. When an engineer leaves the company, you disable their main identity account once. That single change stops them from logging into the project board through the web interface. It also lets you enforce multi-factor rules at the identity provider level.
Still, web login controls only check who enters the front door of the app. They do not govern how engineers run commands on the host server or database. Taiga stores all project tasks, comments, and user profiles inside a PostgreSQL database. Engineers who maintain the app often need direct sessions to this database for fixes.
K8s OIDC Authentication: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
In many teams, engineers share one strong database role to run queries and updates. Once an engineer logs into the database, the identity provider has no view of their actions. A single bad query can wipe out sprint data or expose private user fields. Web login plugins cannot stop a risky command inside a direct database session.
Managing backend database and server sessions
To keep project data safe, teams must look beyond the web login screen. You need controls that check every query and shell command before it runs. Engineers should use their own work identity when they touch the backend database. Shared database passwords make it impossible to see who ran a specific delete statement.
Good access control also means protecting private data inside query results. User tables often hold emails and phone numbers that engineers do not need to read. Data masking rewrites matched fields in results so sensitive strings stay hidden during debugging. Combining web single sign-on with command-level checks gives you full control over your stack.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Does Taiga support OpenID Connect out of the box?
No, the base install uses local passwords. As a result, you must add an open source plugin to both the frontend and backend services.
How does Taiga match OIDC users to existing accounts?
The backend reads the email claim from the identity token and links it to any existing local account with that same email.
Does web single sign-on protect the Taiga PostgreSQL database?
No, web single sign-on only checks users at the web app login screen and does not control direct database queries or server shells.