Viking SSO v1.1.0

Update: upload the new vikingsso.blueprint to your panel root, run blueprint -install vikingsso. Providers, settings and links carry over.

Heads up: accounts with 2FA can no longer log in through SSO by default (it skipped the code check). Toggle "Skip Two-Factor for SSO" if you want the old behaviour.

Note: We have been working on our own full blown theme and extensions for pterodactyl since the release of this in march. Now with the release at the review stage of our new theme hopefully seeing release within a few days - We have also revisited this and been updating it for better compatibility, while also bettering the overall addon for blueprint.

Fixed​

• Steam login was broken in 1.0.0 — validation always failed (PHP mangled Steam's response params)
• Steam link page returned a 500
• SSO errors were invisible on the login page — they now show as a banner above the form
• Editing a disabled provider silently re-enabled it
• Login button script wasn't refreshed on update

Security​

• PKCE (S256) on all OIDC flows
• Steam logins now session-bound with a state token + verified return address
• New per-provider option: Require Verified Email (off by default for existing providers)
• email_verified: "false" sent as a string was treated as verified — fixed
• Discord email matching now requires a verified Discord email
• "No account found" no longer echoes the email/username (account enumeration)
• New toggle: Allow Administrator SSO (on by default)
• New toggle: Skip Two-Factor for SSO (off by default)
• Stricter Steam ID parsing, state/code type checks, provider form validation

Added​

• SFTP password flow — one-time prompt after first SSO login + section on the account page
• Proper login button styling — full width, below the form; inherits VikingCAT tokens when installed, own styling standalone
• Injection status + "Re-inject buttons" on the admin page (for after panel updates)
• Warning when matching by username (usernames can be renamed)
• OIDC discovery caching (1h) + timeouts on all outbound requests

Removed​

• Two dead blade files that were never wired up