Hi team,
I have previously read through some older posts about implementing SSO for Rundeck Community version and it seems this is only available for Commercial/Enterprise versions.
However, I’d like to know if we have alternatives to do that on Community. I saw some posts suggesting pre-auth mode, how could we implement it or even implement other solutions to have SSO on our environment?
Best answer by maria_yarotska
Hey there,
While full SSO (Okta, Ping, Azure AD) is Enterprise/Cloud-only, Rundeck Community does support Pre-authenticated Mode, which gets you a similar outcome.
The idea is to put a reverse proxy (or web server) in front of Rundeck that handles the actual authentication (including SSO with your provider of choice), and it passes the user's identity and roles to Rundeck via HTTP headers — Rundeck then trusts that the user is already authenticated. Key config properties to look at:
- `rundeck.security.authorization.preauthenticated.enabled`
- `.userNameHeader` / `.userRolesHeader` (to pass identity/roles)
- `.redirectLogout` / `.redirectUrl` (for custom logout behavior)
Full reference here: Rundeck Authentication & Authorization docs
Folks in the community have set this up with different reverse proxies paired with an OIDC provider (e.g. Apache + Keycloak, or similar with Okta/Azure AD) — here's a writeup of one such setup if useful.
Hope that gives you a solid starting point!
Hey there,
While full SSO (Okta, Ping, Azure AD) is Enterprise/Cloud-only, Rundeck Community does support Pre-authenticated Mode, which gets you a similar outcome.
The idea is to put a reverse proxy (or web server) in front of Rundeck that handles the actual authentication (including SSO with your provider of choice), and it passes the user's identity and roles to Rundeck via HTTP headers — Rundeck then trusts that the user is already authenticated. Key config properties to look at:
- `rundeck.security.authorization.preauthenticated.enabled`
- `.userNameHeader` / `.userRolesHeader` (to pass identity/roles)
- `.redirectLogout` / `.redirectUrl` (for custom logout behavior)
Full reference here: Rundeck Authentication & Authorization docs
Folks in the community have set this up with different reverse proxies paired with an OIDC provider (e.g. Apache + Keycloak, or similar with Okta/Azure AD) — here's a writeup of one such setup if useful.
Hope that gives you a solid starting point!
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.