Add OpenID Connect SSO with optional authentik blueprint

- SSO_* settings (login only, master password still decrypts the vault)
- optional authentik blueprint: provider with authorization_code/refresh_token grants, application and an email mapping with email_verified, which vaultwarden requires to link SSO logins to existing accounts
- blueprints are copied into the authentik container, it only applies files from /blueprints

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

templates/opt/authentik/vaultwarden-sso.yaml.j2

@@ -0,0 +1,52 @@
+# managed by ansible (cloud-vaultwarden); applied with `ak apply_blueprint`
+version: 1
+metadata:
+  name: "{{ vaultwarden_sso_name }} SSO"
+entries:
+  # vaultwarden only links an SSO login to an existing account for verified addresses
+  - model: authentik_providers_oauth2.scopemapping
+    id: email-verified
+    identifiers:
+      name: "{{ vaultwarden_sso_name }} OpenID 'email' (verified)"
+    attrs:
+      scope_name: email
+      description: Email address (verified)
+      expression: |
+        return {
+            "email": request.user.email,
+            "email_verified": True,
+        }
+
+  - model: authentik_providers_oauth2.oauth2provider
+    id: provider
+    identifiers:
+      name: "{{ vaultwarden_sso_name }}"
+    attrs:
+      authorization_flow: !Find [authentik_flows.flow, [slug, {{ vaultwarden_sso_authentik_authorization_flow }}]]
+      invalidation_flow: !Find [authentik_flows.flow, [slug, {{ vaultwarden_sso_authentik_invalidation_flow }}]]
+      client_type: confidential
+      # newer authentik versions only allow explicitly listed grant types
+      grant_types:
+        - authorization_code
+        - refresh_token
+      client_id: "{{ vaultwarden_sso_client_id }}"
+      client_secret: "{{ vaultwarden_sso_client_secret }}"
+      redirect_uris:
+        - matching_mode: strict
+          url: "https://{{ vaultwarden_domain }}/identity/connect/oidc-signin"
+      signing_key: !Find [authentik_crypto.certificatekeypair, [name, "{{ vaultwarden_sso_authentik_signing_key }}"]]
+      sub_mode: hashed_user_id
+      property_mappings:
+        - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+        - !KeyOf email-verified
+        - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+        - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-offline_access]]
+
+  - model: authentik_core.application
+    identifiers:
+      slug: "{{ vaultwarden_sso_slug }}"
+    attrs:
+      name: "{{ vaultwarden_sso_name }}"
+      provider: !KeyOf provider
+      meta_launch_url: "https://{{ vaultwarden_domain }}/"
+      policy_engine_mode: any

templates/opt/vaultwarden/.env.j2

@@ -19,6 +19,19 @@ ADMIN_TOKEN='{{ vaultwarden_admin_token }}'
 {% endif %}
 
 
+### SSO ###
+SSO_ENABLED={{ vaultwarden_sso_enabled | bool | lower }}
+{% if vaultwarden_sso_enabled | bool %}
+SSO_ONLY={{ vaultwarden_sso_only | bool | lower }}
+SSO_SIGNUPS_MATCH_EMAIL={{ vaultwarden_sso_signups_match_email | bool | lower }}
+SSO_AUTHORITY={{ vaultwarden_sso_authority }}
+SSO_SCOPES="{{ vaultwarden_sso_scopes }}"
+SSO_PKCE=true
+SSO_CLIENT_ID={{ vaultwarden_sso_client_id }}
+SSO_CLIENT_SECRET='{{ vaultwarden_sso_client_secret }}'
+{% endif %}
+
+
 ### SMTP ###
 SMTP_HOST={{ vaultwarden_smtp_host }}
 SMTP_PORT={{ vaultwarden_smtp_port }}