diff --git a/modules/context_processors.py b/modules/context_processors.py
index 1336097..ce83bc7 100644
--- a/modules/context_processors.py
+++ b/modules/context_processors.py
@@ -62,6 +62,11 @@ def sidebar_modules(request):
         # which takes precedence over this processor when both provide it.
         "ejabberd_enabled": getattr(settings, "EJABBERD_ENABLED", False),
         "keycloak_login_enabled": bool(getattr(settings, "PYOBS_AUTH", {}).get("SERVER_URL")),
+        # IdP hint/label for the one-click IdP login button - see PYOBS_AUTH in settings.py.
+        # The template additionally gates on keycloak_login_enabled, so IDP_HINT without
+        # SERVER_URL (Keycloak disabled) degrades to no buttons rather than dead links.
+        "keycloak_idp_hint": getattr(settings, "PYOBS_AUTH", {}).get("IDP_HINT", ""),
+        "keycloak_idp_label": getattr(settings, "PYOBS_AUTH", {}).get("IDP_LABEL", ""),
         "git_enabled": getattr(settings, "PYOBS_CONFIG_GIT_ENABLED", False),
         "acl_matrix_enabled": getattr(settings, "PYOBS_CONFIG_ACL_MATRIX_ENABLED", False),
         "web_admin_version": _web_admin_version(),
diff --git a/pyobs_web_admin/settings.py b/pyobs_web_admin/settings.py
index 9eddd3b..3c8e561 100644
--- a/pyobs_web_admin/settings.py
+++ b/pyobs_web_admin/settings.py
@@ -93,6 +93,11 @@
     "CLIENT_SECRET": "",
     "REDIRECT_URI": "",
     "POST_LOGOUT_REDIRECT_URI": "",
+    # Optional one-click IdP login: IDP_HINT is passed to Keycloak as kc_idp_hint (skips its
+    # login/IdP-selection page, going straight to that identity provider, e.g. GWDG SSO);
+    # IDP_LABEL is the button label on the login page. Both are deployment-specific.
+    "IDP_HINT": "",
+    "IDP_LABEL": "",
     "USER_RESOLVER": "pyobs_web_admin.authentication.keycloak.resolve_user",
 }
 
diff --git a/pyproject.toml b/pyproject.toml
index 70b542a..77b6a45 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,7 +11,7 @@ dependencies = [
     "gunicorn>=26.0.0",
     "packaging>=24.0",
     "psutil>=6.0",
-    "pyobs-auth>=2.0.0.dev7",
+    "pyobs-auth>=2.0.0.dev8",
     "pyyaml>=6.0",
     "requests>=2.32",
     "ruamel.yaml>=0.18",
diff --git a/templates/registration/login.html b/templates/registration/login.html
index 5766ec5..33b5c16 100644
--- a/templates/registration/login.html
+++ b/templates/registration/login.html
@@ -48,9 +48,17 @@ <h5 class="mt-2 mb-0 fw-semibold">pyobs Web Admin</h5>
       </button>
     </form>
 
-    {% if keycloak_login_enabled %}
+    {% if keycloak_idp_hint and keycloak_login_enabled %}
     <hr class="my-4">
-    <a href="{% url 'pyobs_auth:login' %}?next={{ next }}" class="btn btn-outline-secondary w-100">
+    <a href="{% url 'pyobs_auth:login' %}?next={{ next|urlencode }}" class="btn btn-primary w-100">
+      <i class="bi bi-shield-lock me-1"></i>Log in with {{ keycloak_idp_label|default:"Keycloak" }}
+    </a>
+    <a href="{% url 'pyobs_auth:login' %}?idp_hint=&next={{ next|urlencode }}" class="btn btn-outline-secondary w-100">
+      <i class="bi bi-person me-1"></i>Log in with local Keycloak account
+    </a>
+    {% elif keycloak_login_enabled %}
+    <hr class="my-4">
+    <a href="{% url 'pyobs_auth:login' %}?next={{ next|urlencode }}" class="btn btn-outline-secondary w-100">
       <i class="bi bi-shield-lock me-1"></i>Log in with Keycloak
     </a>
     {% endif %}