Open ID Connect

Babandis · October 7, 2025, 3:41pm

First off, just wanted to say I'm a long-time user of Metabase and I absolutely love it. It's been a game-changer for making data accessible in our company. Huge kudos for building such an amazing product! I'm writing to suggest a feature that I believe would be a massive win for a lot of teams, especially as companies grow: native support for OpenID Connect (OIDC) for authentication.Right now, setting up a proper Single Sign-On (SSO) can be a bit of a hack. While there are workarounds, having OIDC as a first-class citizen would make life so much easier.

For many mid-size and large companies, supporting standard SSO protocols like OIDC is a non-negotiable requirement for any new software. Having this natively would make Metabase an even easier "yes" during security reviews.
It just makes Metabase feel more mature and enterprise-ready without complicating it for smaller teams.

dwhitemv · October 8, 2025, 1:45am

There are open features request for this on GitHub, please go upvote them:

github.com/metabase/metabase

Auth: OpenID authentication + API for authorization

opened 01:26PM - 02 Aug 16 UTC

EduardHL

.Security related Type:New Feature Administration/Auth/SSO

Hi, congratulations for building such a good product. Would it be possible to… authenticate users with any OpenID Connect provider? The PR #2818 is specific to Google. It would be great if we could have something more generic. To provide more context: we would like to centralise authentication and authorisation in one place for the different front-ends and APIs we provide to our enterprise users. In order to achieve this we are looking at options like [OpenAM](https://forgerock.org/openam/) or [CAS](https://github.com/apereo/cas). The advantage of having a centralised authentication and authorisation server is that you don't need to duplicate roles and permissions in the different front-ends and APIs. Our enterprise users would ultimately be authenticated with LDAP; using an authentication and authorisation server would allow us to become an OpenID connect provider and check credentials with LDAP. Should #1488 advance further, direct LDAP integration from Metabase could also be an option. Concerning authorization and related to #3088 and #1175, it would be very interesting for us if there could be a generic API/endpoint that we can implement to check if a user can access a specific resource, in the same way in OAuth 2.0 a resource server (server hosting the protected resources; in this case Metabase) may interact with the authorization server (server issuing access tokens; our central authentication and authorization server) to check if a user has access to a resource; this would avoid defining roles for users and resources directly in Metabase. Let us know if these widely adopted protocols and solutions (OpenID connect, separating authorisation server and resource server concerns) would make sense for Metabase and how we can help to make it happen. :arrow_down: Please click the :+1: reaction instead of leaving a `+1` or `update?` comment

github.com/metabase/metabase

Support OAuth 2.0 / OpenID Connect (OIDC) Authorization Code Flow

opened 07:53PM - 22 Feb 23 UTC

paoliniluis

Type:New Feature Administration/Auth/SSO

**Is your feature request related to a problem? Please describe.** Our current …JWT SSO is a custom one similar to JWT bearer flow. It would be nice if we could support more standard flows. **Describe the solution you'd like** Support standard JWT flows like Authorization Code Flow **Describe alternatives you've considered** None **How important is this feature to you?** Requested a few times by leads **Additional context** NA