Rallly OIDC Integration

This document explains how to implement Monosign with Rallly, the open-source application to schedule meetings and collect votes on dates (polls). It covers Single Sign-On with OpenID Connect (OIDC), which is built into Rallly. Rallly reads the Monosign addresses from the OIDC discovery document, uses the Authorization Code flow with PKCE and takes the user from the ID token, so the OIDC/OpenID access key of Monosign is used. Before you continue, it is better to read the Rallly Single Sign-On documentation.

This configuration is done with Rallly 4.15.4 running on Docker (image lukevella/rallly:4.15.4 and postgres:17-alpine). If your Rallly version or deployment type is different, please check the Rallly documentation (single sign-on is available in Rallly v3.4.0 and later).

Rallly supports OpenID Connect (and Google and Microsoft). SAML is not available. There is no single sign-on screen in the Rallly interface; the provider is configured with environment variables. OIDC is enabled only when all four required variables are set (see step 4).

Monofor has no responsibility to do Rallly configurations. If you need support please contact the Rallly community or your Rallly support provider.

Rallly is free for personal use (one user). A multi-user instance asks for a license key (see the Rallly licensing page); the number of users is handled with an honor system, so the single sign-on works without a key.

📑 Instructions

This documentation contains 5 main steps for integration.

Creating an application on Monosign
Configuring the OIDC/OpenID settings on Monosign
Assign a user to the Rallly application
Configuration Single Sign-On for Rallly
Sign In Test

1- Creating an Application on Monosign

Create your application on Monosign first. Open the Applications page from the left menu and click Add New.

Applications page in Monosign (1: Applications menu, 2: Add New)

Rallly is not in the application catalog, so click Create from scratch.

Creating a new application from scratch (1: Create from scratch)

Fill in the application details on the Application tab and click Next.

New Application - Application tab (1: Name, 2: Logo (optional), 3: Next)

Property	Value	Description
Name	`Rallly`	Name of the application shown to users on the Monosign portal and on the Monosign sign-in page.
Type	`Web`	Rallly is accessed through a web browser. Options: Web, Mobile, Desktop, API.
Url	Optional	Leave empty or enter the Rallly address (for example `https://<rallly-address>`). When Rallly is opened from the Monosign portal, it redirects the user directly to the Monosign sign-in (see step 5).
Logo	Optional	Browse and upload a logo; it is also shown on the Monosign sign-in page.
Users can see this application on their list	`Enabled`	Displays the application on the user portal.

On the Access tab define who can reach the application and click Create Application.

Property	Value	Description
User Access Type	`System Default`	Defines which users can access this application. Options: Only Assigned Users, All Users, System Default.
User Group Access Type	`System Default`	Defines the application’s user group access.
Source Using Type	`System Default`	Defines which user sources the application can use.
Profile Access Type	`All`	Defines which user profile attributes are available to the application (Options: Restricted, All). Rallly needs the e-mail address and the name of the user.

Rallly creates an account for every Monosign user who signs in for the first time, and it links accounts that have the same e-mail address (it trusts the e-mail address that Monosign returns). Make sure the effective User Access Type is Only Assigned Users and give access only to the users you assign in step 3.

After the application is created, click Keys and add a new Access Key for OIDC/OpenID access.

Keys tab of the Rallly application (1: Keys, 2: Add New Access Key)

Select OIDC/OpenID as the key type and click Create. Monosign generates the Client Id and Client Secret automatically.

Creating the OIDC/OpenID Access Key (1: Type OIDC/OpenID, 2: Create)

Property	Value	Options
Type	`OIDC/OpenID`	Rest API, OAuth 2.0, JWT, OIDC/OpenID, SAML, RADIUS, Access Gateway, LDAP, AuthN/Z Server
Client Id / Client Secret	Generated automatically	Use the eye icon next to the secret to reveal it. Both values are required in step 4.
Session	`System Default`	System Default, On-demand, Permanent
State	`Enabled`	Enabled, Disabled
Never Expires	`Yes`	Turn off to define a specific expiration date for the key.

Configuration details for the Rallly application are provided as follows:

Monosign value	Example	Used in Rallly as
Client Id	`<client-id>`	`OIDC_CLIENT_ID`
Client Secret	`<client-secret>`	`OIDC_CLIENT_SECRET`
Configuration Url	`https://<monosign-host>/.well-known/openid-configuration`	`OIDC_DISCOVERY_URL`. Rallly reads the Auth, Token, UserInfo and JWKS addresses from this document.

2- Configuring the OIDC/OpenID Settings on Monosign

Click the Configure button of the OpenID Connect (OIDC) key to open the OIDC/OpenID settings. Enter the scopes that Rallly requests and add the callback address of Rallly to Allowed Redirect URIs.

OIDC/OpenID Settings (Scope and Allowed Redirect URIs)

Property	Value	Description
Scope	`openid` `profile` `email`	The scopes that Rallly sends in the authorization request. Add each scope separated by space.
Allowed Redirect URIs	`https://<rallly-address>/api/auth/callback/oidc`	The address where Monosign sends the user back after sign-in. The path `/api/auth/callback/oidc` is fixed by Rallly. Use the public (HTTPS) address of Rallly; it must be the same as `NEXT_PUBLIC_BASE_URL` of step 4.
Signing Key / Key Id / Password, Issuer, Audience, Resource	Empty	Optional custom JWT settings. They are not needed.
Token lifetimes, CORS	Empty	Default values are used.

Rallly reads the e-mail address and the name of the user from the claims email and name (and an optional picture), which Monosign returns by default, so a claim mapping is not required. If you want another claim, set OIDC_EMAIL_CLAIM_PATH, OIDC_NAME_CLAIM_PATH or OIDC_PICTURE_CLAIM_PATH in step 4 (dot notation for nested claims).

3- Assign a User to the Rallly Application

Open the Rallly application in Monosign, click the Assignments tab and click Assign a User. Search and select the users who can sign in to Rallly, check the Expiration Date and save. You can select more than one user.

Property	Value	Description
User(s)	Selected users	Users who can sign in to Rallly with Monosign.
Expiration Date	Default one year	The assignment expires on this date.

4- Configuration Single Sign-On for Rallly

As we mentioned at the start, please check out the Rallly documentation first. Rallly is configured with environment variables. In the Docker Compose deployment add the following variables to the environment file of the Rallly container (for example the .env file that is used with env_file) and replace the placeholder values.

Bash

NEXT_PUBLIC_BASE_URL=https://<rallly-host-name>
OIDC_NAME=Monosign
OIDC_DISCOVERY_URL=https://<monosign-host>/.well-known/openid-configuration
OIDC_CLIENT_ID=<client-id>
OIDC_CLIENT_SECRET=<client-secret>
INITIAL_ADMIN_EMAIL=<administrator-e-mail-address>
EMAIL_LOGIN_ENABLED=false

Variable	Value	Description
NEXT_PUBLIC_BASE_URL	`https://<rallly-host-name>`	Public HTTPS address of Rallly. The redirect address that is sent to Monosign is built from it, so it must match the Allowed Redirect URI of step 2.
OIDC_NAME	`Monosign`	Name of the provider on the sign-in page. Default: OpenID Connect.
OIDC_DISCOVERY_URL	`https://<monosign-host>/.well-known/openid-configuration`	Configuration Url of the Monosign access key. Required.
OIDC_CLIENT_ID / OIDC_CLIENT_SECRET	Client Id / Client Secret	Copied from the Monosign OIDC/OpenID Access Key Details created in the first step. Required. When one of the four required variables is missing, OIDC stays disabled and Rallly writes this to its log.
INITIAL_ADMIN_EMAIL	E-mail address of the administrator	The user who signs in with this e-mail address can open `/control-panel` and claim the administrator role (see step 5).
EMAIL_LOGIN_ENABLED	`false`	Turns off the login with e-mail (one-time code). Rallly then has only the single sign-on and sends the user directly to Monosign. Leave it as `true` (default) if you also want the e-mail login; it needs a working SMTP server (`SMTP_HOST` and the other `SMTP_*` variables).

Rallly also needs the basic variables of every installation. In the Docker deployment that was used for this document they are:

Bash

DATABASE_URL=postgres://rallly:<database-password>@db:5432/rallly
SECRET_PASSWORD=<random-string-with-at-least-32-characters>
NEXT_PUBLIC_SELF_HOSTED=true
SUPPORT_EMAIL=<support-e-mail-address>

The environment file contains the client secret, the database password and the secret of the application. Restrict its permissions (for example chmod 600) and do not store it in a shared repository.

For reference, the Docker Compose file that was used for this document is below. The container runs as a non-root user and listens on port 3000.

YAML

services:
  db:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: rallly
      POSTGRES_DB: rallly
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U rallly -d rallly"]
      interval: 5s
      timeout: 5s
      retries: 10
    volumes:
      - rallly-db:/var/lib/postgresql/data

  rallly:
    image: lukevella/rallly:4.15.4
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    env_file:
      - .env
    ports:
      - "8888:3000"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true

volumes:
  rallly-db:

When Rallly is behind a reverse proxy, the proxy must send the header X-Forwarded-Proto: https. Recreate the Rallly container so that the new variables are loaded:

Bash

cd <rallly-compose-directory>
docker compose up -d --force-recreate rallly

Now try to log in to Rallly using Monosign SSO.

Open a new browser window (or a private window) and type the Rallly address. When the e-mail login is turned off (EMAIL_LOGIN_ENABLED=false), Rallly redirects the browser directly to the Monosign sign-in page of the Rallly application. When the e-mail login is on, the sign-in page of Rallly shows the Monosign button instead.
On the Monosign sign-in page log in passwordless with your QR code (Monofor Identity), with a Passkey or with your user name and password (Sign in with Password). If you are already signed in to Monosign, the page is skipped.

Monosign sign-in page of the Rallly application

After the sign-in Monosign redirects the browser back to Rallly (/api/auth/callback/oidc). At the first sign-in Rallly creates the account and opens the Set up your account page. The name comes from Monosign; choose the time zone, the time format and what you will use Rallly for, and click Continue. The e-mail address of the signed-in user is shown at the bottom of the page.

First sign-in: Set up your account (name from Monosign, signed in with the Monosign e-mail address)

Administrator: sign in with the e-mail address that is set as INITIAL_ADMIN_EMAIL, open https://<rallly-address>/control-panel and claim the administrator role. The Control Panel is the administration screen of Rallly (instance settings, users, license). Rallly has no separate administrator user name and password.

Troubleshooting

Symptom	Cause	Solution
The Monosign button is not shown (and there is no redirect)	One of `OIDC_DISCOVERY_URL`, `OIDC_CLIENT_ID` or `OIDC_CLIENT_SECRET` is missing, so OIDC is disabled. The Rallly log says that OIDC login is disabled and lists the missing variables.	Set all three variables (step 4) and run `docker compose up -d --force-recreate rallly`.
The sign-in page shows no way to log in, or asks for an e-mail address	OIDC is not configured and e-mail login is on, or e-mail login is off without OIDC.	Configure OIDC as in step 4. The e-mail login needs SMTP; without SMTP use `EMAIL_LOGIN_ENABLED=false` and the single sign-on.
Monosign shows a redirect URI error	The redirect address that Rallly sends does not exactly match the Allowed Redirect URIs, for example because `NEXT_PUBLIC_BASE_URL` is wrong.	Add `https://<rallly-address>/api/auth/callback/oidc` in Monosign (step 2) and set `NEXT_PUBLIC_BASE_URL` to the same public HTTPS address.
Rallly cannot reach Monosign (error in the log about the discovery document, certificate or network)	The container cannot resolve or trust the address of Monosign.	Check `OIDC_DISCOVERY_URL`, the DNS and firewall rules of the Rallly host and that the certificate of Monosign is issued by a trusted CA.
The name of the user is empty or wrong	The `name` claim is missing or another claim should be used.	Set `Profile Access Type` to All (step 1) or set `OIDC_NAME_CLAIM_PATH` to the right claim.
The user cannot open `/control-panel` as administrator	The e-mail address of the user is not the value of `INITIAL_ADMIN_EMAIL`.	Sign in with the administrator e-mail address, or change `INITIAL_ADMIN_EMAIL` and recreate the container.
A user cannot sign in	The user is not assigned to the application.	Assign the user in step 3.
The log warns that `OIDC_ISSUER_URL` is no longer used	An old variable from an earlier Rallly version is still set.	Remove `OIDC_ISSUER_URL`; only `OIDC_DISCOVERY_URL` is used.
SAML sign-in is required	Rallly supports OpenID Connect (and Google and Microsoft), not SAML.	Use the OIDC integration in this document.

After completing the configuration on Rallly and Monosign, it is better to test in a new private browser window if the OIDC SSO doesn’t work, because old session cookies of the Rallly address may cause errors.

📑 Instructions

1- Creating an Application on Monosign

2- Configuring the OIDC/OpenID Settings on Monosign

3- Assign a User to the Rallly Application

4- Configuration Single Sign-On for Rallly

5- Sign In Test

Troubleshooting