The SSO Tax: Which Self-Hosted Apps Are Actually Worth It?
The urge to SSO everything
When you stand up a self-hosted identity layer, the first instinct is to point everything at it. One login, one place to revoke access, one clean kill switch. It’s a satisfying picture.
The second instinct — the one that actually matters — is to ask what single sign-on is buying you, and what it quietly breaks.
The test that matters
For me, SSO is only worth doing when two things are true. I can trace an action inside an app back to an individual, not just “someone who cleared the login screen.” And putting an app behind SSO doesn’t quietly hand every authenticated person the same keys.
If an app gives every member of a group full admin the moment they log in, that’s not single sign-on. That’s a door with one handle and a sign that says “please don’t.” That’s the line I won’t cross.
The three buckets
Running every app in the stack through that test produces three piles, and they’re satisfyingly clean.
- The good fits are apps with native OpenID Connect and a real per-user model — Grafana, Paperless-ngx, Portainer, Wiki.js, Homebox, Komodo. Each person gets their own account, groups map to roles, and admin is something you grant on purpose. These are worth the effort.
- The caveats are the proxy-only apps — Sonarr, Radarr, Tautulli, the dashboards, the monitoring surfaces. There’s no native SSO, so the proxy sits in front and gates the door, but the app itself has one shared login. Fine for a single-admin home lab, but it buys you no per-person attribution.
- The not-fits are the interesting ones. Plex runs its own cloud identity and can’t be an SSO client. Home Assistant has its own token model and no clean OIDC path — wrapping it in a proxy would grant blanket access, not attribution. InfluxDB and Prometheus are admin UIs you reach through Grafana anyway, so SSO-ing them directly adds nothing.
The SSO tax, in the wild
The audit surfaced a few surprises worth naming, because they’re the kind of thing you only learn by checking.
n8n ships OIDC and SAML — but only in the Business and Enterprise tiers. The community edition has no SSO at all. There’s a third-party community plugin that bridges the gap, but “native OIDC” on the tin doesn’t mean “native OIDC for you.”
Seerr’s OIDC support is real but still lives in a preview branch, not the stable image. The mature path is its existing Plex-based sign-in, and chasing the preview would be paying the SSO tax twice.
And in the other direction, Komodo turned out to support native OIDC when I’d assumed it was proxy-only. Assumptions are cheap; checking is what the catalog is for.
The bug that looked like a broken connection
The one genuinely teeth-grinding moment was the directory sync. It kept throwing an error that read like a severed link — except the bind worked, the certificate matched, and the scheduled sync was succeeding every fifteen minutes.
The real cause was a single trigger passing the source’s name where the system expected its ID. A slug where a UUID belonged. One string in the wrong shape, and every symptom pointed at the network.
It’s a good reminder that “the connection is broken” is often a story the error message is telling you, not the truth. The truth was one field that had drifted.
The full catalog
Every application in the register, scored by the same three questions: does it do native OIDC, does it collapse to a single shared login, and how much effort is it to bring under single sign-on.
| Application | Native OIDC | Native LDAP | One user only | Level of effort | Done | Notes |
|---|---|---|---|---|---|---|
| Grafana | Yes | Yes | No | Medium | ||
| Paperless-ngx | Yes | No | No | Medium | Yes | OIDC only; no directory bind |
| Portainer | Yes | Partial | No | Medium | N/A | Software will be sunset |
| Wiki.js | Yes | Yes | No | Medium | No | Off Network – not sure how this would work |
| Homebox | Yes | No | No | Medium | OIDC only | |
| Komodo | Yes | Yes | No | Medium | Yes | |
| NetBox | Yes | Yes | No | Medium | ||
| Discourse | Yes | Partial | No | Medium | Yes | LDAP needs a plugin |
| Mealie | Yes | Yes | No | Medium | ||
| Vikunja | Yes | Yes | No | Medium | ||
| DoneTick | Yes | No | No | Medium | OIDC only | |
| Homarr | Yes | Yes | No | Medium | ||
| AdventureLog | Yes | No | No | Medium | OIDC only | |
| Sonarr | No | No | Yes | Low | ||
| Radarr | No | No | Yes | Low | ||
| Tautulli | No | No | Yes | Low | ||
| Maintainerr | No | No | Yes | Low | ||
| SearXNG | No | No | Yes | Low | I need to see what the | |
| Uptime Kuma | No | No | Yes | Low | admin-only tool | |
| Pi-hole | No | No | Yes | Low | admin-only tool | |
| Backrest | No | No | Yes | Low | admin-only tool | |
| NZBHydra2 | No | No | Yes | Low | Aura said this isn’t possible – I’m pretty sure it is | |
| IT-Tools | No | No | Yes | Low | ||
| Homepage | No | No | Yes | Low | Yes | superseded by Homarr |
| PriceBuddy | No | No | Yes | Low | Yes | I’m not sure if this is valuable enough to keep around |
| Paperclip | No | No | Yes | Low | custom app | |
| Paper-Ledger | No | No | Yes | Low | custom app | |
| Flightlog | No | No | Yes | Low | ||
| n8n | Partial | Partial | Yes | High | OIDC + LDAP are Business/Enterprise-only | |
| Seerr | Partial | No | No | Low | OIDC preview-only; use Plex SSO | |
| ntfy | No | No | No | Low | token auth, not SSO | |
| Plex | No | No | — | — | — | Plex.tv cloud auth |
| Home Assistant | No | No | — | — | — | own auth model |
| InfluxDB | No | No | — | — | — | access via Grafana |
| Prometheus | No | No | — | — | — | access via Grafana |
| HomeLable | No | No | Yes | — | — | no per-user attribution |
The LDAP question
The follow-up worth asking: if an app already speaks OIDC, does it also speak LDAP directly? If so, we could bind those apps to the directory and skip the identity layer in front of them.
It doesn’t collapse that cleanly. Seven of the OIDC apps also do native LDAP — Grafana, Wiki.js, Komodo, NetBox, Mealie, Vikunja, Homarr. Those could bind straight to the directory and drop the OIDC hop. But Paperless-ngx, Homebox, DoneTick, and AdventureLog are OIDC-only, so there’s no directory bind for them, and Portainer, Discourse, and n8n only do LDAP partially or behind a paid tier.
So Authentik isn’t redundant — but the LDAP column is the short list of apps that could stand alone if we ever wanted to slim the layer down.
What I’d tell a past version of me
Don’t start from “what can I SSO?” Start from “where does individual accountability actually matter, and where is a shared login honestly fine?” The catalog then writes itself, and the not-fits stop feeling like failures and start feeling like clarity.
