Samba & SMB Web Access Through Sambee With Automatic HTTPS & OIDC SSO

Home Automation, Networking & Self-Hosting
Published Jul 12, 2026 Updated Aug 11, 2026

This article explains how to set up Sambee in a Docker container as a web interface for browser-based access to a Samba or SMB file server, complete with automatic HTTPS certificates (via Caddy) and OpenID Connect single sign-on (via Authelia).

This article is part of a mini-series about running Samba Active Directory and a file server service in a Docker container on a home server:

Samba Active Directory in a Docker Container: Installation Guide
Samba Active Directory as Authelia’s Authentication Backend
Samba File Server With Windows ACLs in a Docker Container
Samba File Server With POSIX ACLs in a Docker Container
Web Access Through Filebrowser With SSO & HTTPS
Web Access Through Filestash With Passthrough Auth
Web Access Through Sambee With Automatic HTTPS (this article)
Auditing Samba File & Directory Changes With Elasticsearch
GitHub repository with Docker files and helper scripts

Sambee Installation

Installing Sambee via its Docker image is straightforward (docs).

Preparation

I’m assuming that you’ve set up Docker, the Caddy container and a Samba file server as described in previous articles.

Dockerized Sambee Directory Structure

This is what the directory structure will look like when we’re done:

rpool/
 └── encrypted/
     └── docker/
         └── sambee/
             ├── data/
             └── docker-compose.yml

We’re placing the configuration on the encrypted ZFS dataset (rpool/encrypted).

Create the new directories and set their ownership to user/group ID 1000, which is used by the containerized application:

mkdir -p /rpool/encrypted/docker/sambee/data
chown -Rfv 1000:1000 /rpool/encrypted/docker/sambee/data

Sambee Docker Compose File

Create docker-compose.yml with the following content:

services:

  sambee:
    container_name: sambee
    hostname: sambee
    # Release channels:
    # test: preview builds
    # beta: prerelease builds
    # stable: production builds (not available yet)
    image: ghcr.io/helgeklein/sambee:beta
    restart: unless-stopped
    networks:
      caddy_caddynet:                           # Frontend communications
    expose:
      - 8000                                    # Web UI, Sambee to Caddy
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./data:/app/data

networks:
  caddy_caddynet:
    external: true

Start the Sambee Container And Retrieve the Initial Admin Password

Navigate into the directory with docker-compose.yml and run:

docker compose up -d

When the Sambee container is first started, it sets up the required files in the data subdirectory, creates an admin user, and prints the password only once.

Run the following to retrieve the initial admin password:

docker compose logs sambee --tail 100 | grep -A 5 "FIRST-TIME SETUP"

Let’s Encrypt Certificate for Sambee via Caddy

Caddyfile

Add the following to Caddyfile (details):

files.{$MY_DOMAIN} {
	reverse_proxy sambee:8000 {
	}
	tls {
		dns cloudflare {env.CLOUDFLARE_API_TOKEN}
	}
}

DNS A Record

Add the following A record to your DNS domain:

files.home.yourdomain.com 192.168.0.4     # replace with your Docker host's IP address

Try to resolve the name on a machine in your network (e.g., nslookup files.home.yourdomain.com).

Reload Caddy’s Configuration

Instruct Caddy to reload its configuration by running:

docker exec -w /etc/caddy caddy caddy reload

You should now be able to access the Sambee web interface at https://files.home.yourdomain.com without getting a certificate warning from your browser.

SSO to Sambee via OpenID Connect (OIDC) Authentication to Authelia

This section describes how to set up single sign-on to Sambee via OpenID Connect authentication to Authelia. It is based on the Sambee OIDC docs.

Sambee: Retrieve OIDC Callback URI

Access Sambee’s UI at https://files.home.yourdomain.com and sign in as admin with the password you retrieved earlier.

Navigate to Settings by clicking the gear icon or pressing Ctrl+,, select Network, and enter your equivalent of https://files.home.yourdomain.com in Public URL. Save the changes.

Select the Authentication category, choose OIDC as Authentication mode, and click Configure OIDC. In the dialog that opens, copy the Redirect URI. You’ll need it for the Authelia configuration in the next step.

Authelia: Configure OpenID Connect IdP

Client Secret

The shared secret between Sambee and Authelia is entered as plaintext in the Sambee UI but as a hash of the plaintext in Authelia’s configuration. Create a new secret by running the following command (docs):

docker run --rm authelia/authelia:latest authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986

The relevant command output looks like this:

Random Password: v0e1zWJhvKQYud1lVUx4XhLibOwp0zyd
Digest: $pbkdf2-sha512$310000$vFbvgWgmhAIdZCbcLsrrXA$yRENW40rZpWLUP2ABQglEAhIHgpl7QAJ3eq8ZDEMmEHDL9Rro3eGwQ/4u05JsSLsEO5NIw.iAWVbo7EsiL8V1w

The random password is your plaintext secret whereas the digest is your hashed secret.

YAML Configuration File

Add the following to the Authelia configuration file config/configuration.yml (details):

identity_providers:
  oidc:
    lifespans:
      custom:
        sambee:
          # Maximum useful length: Sambee's interactive sign-in interval + 1 day
          refresh_token: '31d'
    clients:
      - client_id: sambee
        client_name: Sambee
        # Replace the client_secret value with the hashed secret you generated
        client_secret: 'HASHED_SECRET_GOES_HERE'
        redirect_uris:
          - https://files.home.yourdomain.com/api/auth/oidc/callback
        grant_types:
          - authorization_code
          - refresh_token
        response_types:
          - code
        lifespan: sambee
        scopes:
          - openid
          - profile
          - email
          - offline_access
          # Add groups when using group admission or group-based role mappings.
          - groups

Restart Authelia

Navigate to the authelia directory and run:

docker compose restart

Inspect the container logs for errors with the command docker compose logs --tail 30 --timestamps.

Sambee: Enable OIDC Authentication

Return to Sambee’s Configure OIDC dialog and fill out the fields as follows:

Provider name: Authelia
Issuer URL: https://auth.home.yourdomain.com (adjust to your domain)
Client ID: sambee
Client secret: fill in the plaintext secret you generated above
Scopes: openid, profile, email, groups, offline_access
Admission: All authenticated users
Role assignment: All users are assigned to the same role
Assigned role: Editor

Create Access Group (Optional)

If you want to limit access to Sambee to the members of a certain group:

Open an interactive shell in your Samba container: docker exec -it samba bash
Create a group: samba-tool group add sambee_access --groupou="OU=Groups,OU=My"
Add members to the new group: samba-tool group addmembers sambee_access USERNAME

Modify the following in Sambee’s Configure OIDC dialog:

Admission: All authenticated users
Admission groups: sambee_access

Connect and test

Click Connect and test. This prompts you to sign in via OIDC to verify two things:

OIDC authentication works with the values you provided
Your account will still be a Sambee admin once logging in via OIDC

If the test is successful, click Activate configuration.

OIDC Users are Auto-Provisioned in Sambee

That’s it! With the above configuration, OIDC users can sign in to Sambee. If you configured an access group, Sambee requires OIDC users to be members of that group.

It’s not necessary to create users in Sambee. When OIDC is enabled, your IdP becomes the source of truth, and users are automatically provisioned in Sambee.

You can, of course, inspect and manage users in Sambee: navigate to Settings > User Management and take a look around.