archived-drop-docs/docs/authentication/oidc.md

OpenID Connect

OpenID Connect is a OAuth2 extension support by most identity providers.

Configure OpenID Connect

To configure OIDC, you must set the following environment variables:

Variable	Usage
OIDC_CLIENT_ID	Client ID from your identity provider.
OIDC_CLIENT_SECRET	Client secret from your identity provider.
OIDC_ADMIN_GROUP	Grant admin to users with this group configured in your identity provider. Tested with Authentik.
DISABLE_SIMPLE_AUTH (optional)	Disable simple auth
OIDC_USERNAME_CLAIM (optional)	Change the field that Drop pulls the username claim from. Users are merged based on their usernames
OIDC_PROVIDER_NAME (optional)	Change the name of the oidc provider that is displayed on the sign-in page. Default is external provider.

And then, you must configure either:

OIDC_WELLKNOWN: A unprotected endpoint that returns a OIDC well-known JSON. Fetched on startup

---

Individual endpoints

Variable	Usage
OIDC_AUTHORIZATION	Authorization endpoint. Usually ends with authorize.
OIDC_TOKEN	Token endpoint. Usually ends with token.
OIDC_USERINFO	Userinfo endpoint. Usually ends with userinfo.
OIDC_SCOPES	Comma separated list of scopes. Requires, at least, openid and email.

Redirect URL

Drop uses the EXTERNAL_URL environment variable to create the callback URL: $EXTERNAL_URL/auth/callback/oidc.