otso2200/oai-team-sso-oidc

OpenaiTemsSsoOidc is a small, self hosted OpenID Connect provider built to give a company a working Custom OIDC single sign on connection to OpenAI Business accounts. The idea is to use as few moving parts as possible to cover the basic enterprise login path: OpenAI sends a user to this service, the service checks that the person's email domain is allowed and, if turned on, asks for a login passcode, then it hands back an OIDC compatible authorization code, access token, ID token, and user profile information. The service exposes the standard OIDC endpoints: a discovery document at /.well-known/openid-configuration, a public key list at /.well-known/jwks.json, a login page at /oauth2/authorize, a token exchange endpoint at /oauth2/token, and a user info endpoint at /oauth2/userinfo. It can prefill the email field when OpenAI passes a login hint, email, or username, and it can lock the email prefix and domain so the user cannot change them in the browser, though the server still checks the domain again on its own side. An optional login passcode can be required, stored as plain text, bcrypt, sha256, or sha512, and an optional Cloudflare Turnstile check can be placed in front of the login form. To run it, you copy the example environment file to .env, then set required values such as the public issuer URL, OIDC client ID and secret, allowed redirect addresses, allowed email domains, and the path to the RSA signing key, which the service can generate itself if none exists. You can start it directly with go run, or build and run it as a Docker container, including a ready made docker compose file. A GitHub Actions workflow is included that builds and publishes a container image to GitHub Container Registry automatically on pushes to main or on version tags. The project is written in Go, has 15 stars, and is released under the Apache License 2.0. The README is aimed at someone setting up enterprise login for OpenAI Business, so it assumes some familiarity with running backend services and Docker.