Skip to main content

Integrate with Synology DSM (DiskStation Manager)

Support level: Community

What is Synology DSM?​

Synology Inc. is a Taiwanese corporation that specializes in network-attached storage (NAS) appliances. Synology's line of NAS is known as the DiskStation for desktop models, FlashStation for all-flash models, and RackStation for rack-mount models. Synology's products are distributed worldwide and localized in several languages.

-- https://www.synology.com/en-global/dsm

Preparation​

The following placeholders are used in this guide:

  • synology.company is the FQDN of the Synology DSM server.
  • authentik.company is the FQDN of the authentik installation.
info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

authentik configuration​

Redirect URI changes in authentik 2026.5

In authentik versions earlier than 2026.5, all Redirect URIs are automatically treated as Authorization type. If you are using one of these older authentik versions, add only the Authorization URL to your Redirect URIs and do not configure a Post Logout URI.

To support the integration of Synology DSM with authentik, you need to generate an RSA signing key and create an application/provider pair in authentik.

Create an RSA signing key​

Synology DSM requires ID tokens that are signed with an RSA key. If an RSA certificate-key pair is not already available:

  1. In the authentik Admin interface, navigate to System > Certificates.
  2. Click Generate.
  3. Enter a descriptive Common Name, such as Synology DSM.
  4. For Private key Algorithm, select RSA.
  5. Click Generate.

You can use the generated self-signed certificate-key pair for token signing. The certificate does not need to be issued by a public certificate authority because DSM obtains the public signing key from authentik's JWKS endpoint.

Create an application and provider​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Applications and click New Application to open the application wizard.
    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
    • Choose a Provider type: select OAuth2/OpenID Connect as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Note the Client ID and Client Secret values because they will be required later.
      • Add a Redirect URI of type Strict Authorization as https://synology.company.
      • For Signing Key, select a certificate-key pair that uses an RSA private key. Synology DSM does not accept ID tokens signed with an ECDSA key.
      • Under Advanced protocol settings, set the Subject mode to be based on the user's email.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page.
  3. Click Submit to save the new application and provider.

Map existing DSM usernames​

Skip this section if each user's authentik username already matches their DSM account name.

DSM does not create a user during an OIDC login. An account must already exist in the selected DSM account type, and its username must exactly match the preferred_username claim. By default, authentik sets preferred_username to the authentik user's username.

If the usernames differ, edit each authentik user and add their existing DSM username to the Attributes field. For example:

synology_username: existing-dsm-username

Then create a custom profile scope mapping:

  1. In the authentik Admin interface, navigate to Customization > Property Mappings.

  2. Click New Property Mapping, select OAuth2/OpenID Scope Mapping, and click Next.

  3. Configure the following values:

    • Name: Synology DSM profile

    • Scope name: profile

    • Expression:

      return {
          "preferred_username": request.user.attributes.get(
              "synology_username",
              request.user.username,
          ),
      }

  4. Click Finish.

  5. Edit the Synology DSM OAuth2/OIDC provider.

  6. Under Scopes, replace the default profile scope mapping with the Synology DSM profile mapping. Keep the openid and email mappings selected, and leave any other selected mappings unchanged.

  7. Save the provider.

The mapping uses synology_username when it is set and otherwise uses the authentik username.

Synology DSM configuration​

To configure Synology DSM to utilize authentik as an OpenID Connect 1.0 Provider:

  1. In the DSM Control Panel, navigate to Domain/LDAP > SSO Client.

  2. Check the Enable OpenID Connect SSO service checkbox in the OpenID Connect SSO Service section.

  3. Configure the following values:

    • Profile: OIDC
    • Account type: Domain/LDAP/local
    • Name: authentik
    • Well Known URL: copy the OpenID Configuration URL from the authentik provider.
    • Application ID: enter the Client ID from the authentik provider.
    • Application Key: enter the Client Secret from the authentik provider.
    • Redirect URL: https://synology.company
    • Authorization Scope: openid profile email
    • Username Claim: preferred_username

  4. Save the settings.

Existing DSM account required

DSM does not create users during an OIDC login. Before a user logs in through authentik, an account must already exist in the selected DSM account type. The account name must exactly match the value of the preferred_username claim.

Troubleshooting​

Troubleshoot not privilege errors​

Error not privilege

The login process can fail with a not privilege error when the SSO pop-up is blocked. Allow pop-ups for the DSM site in the browser configuration.

This error can also happen when you have multiple redirect URI entries but DSM uses only the last one during login. DSM matches the redirect URI based on the Host and HTTPS headers, so do not add #/signin to the redirect URI.

Troubleshoot an improperly configured SSO message​

DSM displays Your SSO is not properly configured. Please check your settings or contact your system administrator. for multiple OIDC configuration problems.

Check the signing algorithm​

Open the authentik provider's OpenID Configuration URL and confirm that it contains the following value:

"id_token_signing_alg_values_supported": ["RS256"]

If it contains an ECDSA algorithm such as ES256 or ES384, edit the authentik provider and select an RSA certificate-key pair for Signing Key.

Check the username claim​

Confirm that the preferred_username claim exactly matches an existing account in the DSM account type selected under SSO Client. If the authentik and DSM usernames differ, configure the custom profile scope mapping described in Map existing DSM usernames.

For additional diagnostic information, review /var/log/packages/OAuthService.log on the Synology system. Logs can contain identifying or security-sensitive information; review them before sharing their contents.

Configuration verification​

To confirm that authentik is properly configured with Synology DSM, log out, open Synology DSM, and log in through authentik.

Resources​