One login.
Every internal app.

# pip install authlib fastapi itsdangerous
from fastapi import FastAPI, Request, Depends, HTTPException
from fastapi.responses import RedirectResponse
from authlib.integrations.starlette_client import OAuth
from starlette.middleware.sessions import SessionMiddleware
import os

app = FastAPI()
app.add_middleware(SessionMiddleware, secret_key=os.environ["SESSION_SECRET"])

oauth = OAuth()
oauth.register(
    name="authentik",
    client_id=os.environ["OIDC_CLIENT_ID"],
    client_secret=os.environ["OIDC_CLIENT_SECRET"],
    server_metadata_url=os.environ["OIDC_ISSUER_URL"] + ".well-known/openid-configuration",
    client_kwargs={"scope": "openid email profile groups"},
)

@app.get("/login")
async def login(request: Request):
    return await oauth.authentik.authorize_redirect(
        request, request.url_for("auth_callback"))

@app.get("/auth/callback")
async def auth_callback(request: Request):
    token = await oauth.authentik.authorize_access_token(request)
    user = token["userinfo"]
    request.session["user"] = {
        "sub":    user["sub"],
        "email":  user["email"],
        "groups": user.get("groups", []),
        # Custom ERP claims from F-05
        "m3_roles":        user.get("m3_roles", []),
        "ar_access_level": user.get("ar_access_level", "none"),
    }
    return RedirectResponse(url="/")

async def require_auth(request: Request) -> dict:
    user = request.session.get("user")
    if not user:
        raise HTTPException(status_code=401)
    return user

@app.get("/dashboard")
async def dashboard(user: dict = Depends(require_auth)):
    return {"hello": user["email"], "groups": user["groups"]}

# pip install mozilla-django-oidc

# settings.py
INSTALLED_APPS += ["mozilla_django_oidc"]
AUTHENTICATION_BACKENDS = ["myapp.auth.AuthtikBackend"]

OIDC_RP_CLIENT_ID     = os.environ["OIDC_CLIENT_ID"]
OIDC_RP_CLIENT_SECRET = os.environ["OIDC_CLIENT_SECRET"]
OIDC_RP_SIGN_ALGO     = "RS256"
OIDC_OP_JWKS_ENDPOINT          = ISSUER + "jwks/"
OIDC_OP_AUTHORIZATION_ENDPOINT = ISSUER + "authorize/"
OIDC_OP_TOKEN_ENDPOINT         = ISSUER + "token/"
OIDC_OP_USER_ENDPOINT          = ISSUER + "userinfo/"
OIDC_RP_SCOPES = "openid email profile groups"
LOGIN_URL          = "/oidc/authenticate/"
LOGIN_REDIRECT_URL = "/"

# urls.py
urlpatterns = [path("oidc/", include("mozilla_django_oidc.urls")), ...]

# auth.py — sync AD groups + custom ERP claims to local user
from mozilla_django_oidc.auth import OIDCAuthenticationBackend
from django.contrib.auth.models import Group

class AuthtikBackend(OIDCAuthenticationBackend):
    def update_user(self, user, claims):
        user.groups.clear()
        for name in claims.get("groups", []):
            group, _ = Group.objects.get_or_create(name=name)
            user.groups.add(group)
        profile = user.profile
        profile.m3_roles        = claims.get("m3_roles", [])
        profile.ar_access_level = claims.get("ar_access_level", "none")
        profile.save()
        return super().update_user(user, claims)

# views.py
from django.contrib.auth.decorators import login_required

@login_required
def dashboard(request):
    return render(request, "dashboard.html", {"user": request.user})

// npm install openid-client express-session
const { Issuer, generators } = require("openid-client");
const session = require("express-session");

let client;
async function initOIDC() {
  const issuer = await Issuer.discover(process.env.OIDC_ISSUER_URL);
  client = new issuer.Client({
    client_id:     process.env.OIDC_CLIENT_ID,
    client_secret: process.env.OIDC_CLIENT_SECRET,
    redirect_uris: ["https://yourapp.example.com/auth/callback"],
    response_types: ["code"],
  });
}

function requireAuth(req, res, next) {
  if (!req.session.user) return res.redirect("/login");
  next();
}

app.get("/login", (req, res) => {
  req.session.state = generators.state();
  req.session.nonce = generators.nonce();
  res.redirect(client.authorizationUrl({
    scope: "openid email profile groups",
    state: req.session.state,
    nonce: req.session.nonce,
  }));
});

app.get("/auth/callback", async (req, res) => {
  const params = client.callbackParams(req);
  const tokenSet = await client.callback(
    "https://yourapp.example.com/auth/callback", params,
    { state: req.session.state, nonce: req.session.nonce }
  );
  const claims = tokenSet.claims();
  req.session.user = {
    sub:           claims.sub,
    email:         claims.email,
    groups:        claims.groups        || [],
    // Custom ERP claims from F-05
    m3Roles:       claims.m3_roles      || [],
    arAccessLevel: claims.ar_access_level || "none",
  };
  res.redirect("/");
});

app.get("/dashboard", requireAuth, (req, res) => res.json(req.session.user));

// composer require league/oauth2-client
<?php
use League\OAuth2\Client\Provider\GenericProvider;
session_start();

$issuer   = getenv("OIDC_ISSUER_URL");
$provider = new GenericProvider([
    "clientId"                => getenv("OIDC_CLIENT_ID"),
    "clientSecret"            => getenv("OIDC_CLIENT_SECRET"),
    "redirectUri"             => "https://yourapp.example.com/callback.php",
    "urlAuthorize"            => $issuer . "authorize/",
    "urlAccessToken"          => $issuer . "token/",
    "urlResourceOwnerDetails" => $issuer . "userinfo/",
    "scopes"                  => "openid email profile groups",
]);

// login.php — start the dance
if (!isset($_GET["code"])) {
    $_SESSION["oauth2state"] = $provider->getState();
    header("Location: " . $provider->getAuthorizationUrl());
    exit;
}

// callback.php — exchange code for token
if ($_GET["state"] !== $_SESSION["oauth2state"]) exit("CSRF");

$token = $provider->getAccessToken("authorization_code", ["code" => $_GET["code"]]);
$user  = $provider->getResourceOwner($token)->toArray();

$_SESSION["user"] = [
    "sub"             => $user["sub"],
    "email"           => $user["email"],
    "groups"          => $user["groups"]          ?? [],
    // Custom ERP claims from F-05
    "m3_roles"        => $user["m3_roles"]        ?? [],
    "ar_access_level" => $user["ar_access_level"] ?? "none",
];
header("Location: /index.php");