Guide: Technitium SSO with Authelia (OpenID Connect) — incl. the back-channel DNS pitfall

[Alvinwylim]

Sharing a working setup for Technitium DNS Server v15.2 web-console SSO using Authelia v4.39 as the OpenID Connect provider — single login, group-based role mapping. Posting mainly because one non-obvious pitfall cost me a lot of time and isn't covered elsewhere.

⚠️ The pitfall (read this first)

Technitium resolves its own outbound requests — the OIDC discovery / token / JWKS back-channel — through its own DNS engine, not the OS /etc/hosts or stub resolver. If your IdP URL is internal-only (split-horizon / no public DNS record), Technitium fails with "Failed to reach SSO provider" even though curl https://auth.example.com/.well-known/openid-configuration works fine from the same box (curl uses the OS resolver; Technitium doesn't).

Fix: make the IdP hostname resolvable by Technitium itself — e.g. add an internal authoritative record for it on the Technitium server, and verify with dig +short @127.0.0.1 auth.example.com on the Technitium host. Also confirm Technitium can reach the IdP on TCP 443.

Technitium side (Administration → Sessions → Single Sign-On)

• Metadata Address: https://auth.example.com/.well-known/openid-configuration
• Client ID / Secret: from your IdP
• Scopes: openid, profile, email, groups (+ a custom scope if your IdP delivers groups under a roles claim — see below)
• Group Map: Remote Group (e.g. dns-admins) → Local Group (Administrators)
• Allow New User Sign Up + Allow Sign Up Only For Mapped Users
• Save Config (the web service auto-restarts)

The redirect/callback URI is https://<your-console>/sso/callback (shown on the SSO page) — register it in your IdP.

Group claim note

Technitium maps SSO users to local groups from a group claim, whose exact name isn't documented. Having the IdP deliver the user's groups in both the standard groups claim and a custom roles claim works reliably regardless.

Authelia side

Full Authelia client config (claims policy, authorization policy, custom scope, redirect URI) is in this integration guide (PR pending review):
👉 authelia/authelia#12331

Keep a local admin account active alongside SSO as break-glass (the IdP is a dependency).

Happy to answer questions / refine.

[ShreyasZare]

Thanks for sharing it here. I will add another note in there about the internal DNS resolution being done.