vmauth: Add single sign-on on (SSO) feature

Author: tiny-pangolinCreated Jan 12, 2026Updated Sep 18, 2026
Labelsenhancementvmauthsecurity

Is your feature request related to a problem? Please describe

In order to use OIDC with vmui it requires using third party tools like oauth2proxy or pomerium which can be challenging to configure especially when manipulating query params and headers on a per-user basis, and it also requires using 3rd party tools which can look bad to users since they are going to vmui but the branding the see when signing in is for oauth2proxy.

Describe the solution you'd like

I would like vmauth to have a login page that unauthenticated users are redirected to if a credential is not found in their browser so all authentication is handled by 1st party tools.

Describe alternatives you've considered

  • use data vis tools like Grafana or Perses, but they do have access to all tools like cardinality explorer, and some environments cannot use those tools
  • use 3rd party tools to implement OIDC like oauth2proxy or pomerium

Additional information

This requires #9439 to be implemented

Source: VictoriaMetrics/VictoriaMetrics