mirror of
https://github.com/Drop-OSS/drop-docs.git
synced 2026-08-27 09:31:25 -04:00
Paco
36 lines
2.2 KiB
Markdown
36 lines
2.2 KiB
Markdown
# OpenID Connect
|
|
|
|
OpenID Connect is a OAuth2 extension support by most identity providers.
|
|
|
|
## Configure OpenID Connect
|
|
|
|
To configure OIDC, you must set the following environment variables:
|
|
|
|
| Variable | Usage |
|
|
| -------------------------------- | ----------------------------------------------------------------------------------------------------------- |
|
|
| `OIDC_CLIENT_ID` | Client ID from your identity provider. |
|
|
| `OIDC_CLIENT_SECRET` | Client secret from your identity provider. |
|
|
| `OIDC_ADMIN_GROUP` | Grant admin to users with this group configured in your identity provider. Tested with Authentik. |
|
|
| `DISABLE_SIMPLE_AUTH` (optional) | Disable simple auth |
|
|
| `OIDC_USERNAME_CLAIM` (optional) | Change the field that Drop pulls the username claim from. Users are merged based on their usernames |
|
|
| `OIDC_PROVIDER_NAME` (optional) | Change the name of the oidc provider that is displayed on the sign-in page. Default is `external provider`. |
|
|
|
|
And then, you must configure **either**:
|
|
|
|
#### `OIDC_WELLKNOWN`: A unprotected endpoint that returns a OIDC well-known JSON. Fetched on startup
|
|
|
|
---
|
|
|
|
#### Individual endpoints
|
|
|
|
| Variable | Usage |
|
|
| -------------------- | ------------------------------------------------------------------------- |
|
|
| `OIDC_AUTHORIZATION` | Authorization endpoint. Usually ends with `authorize`. |
|
|
| `OIDC_TOKEN` | Token endpoint. Usually ends with `token`. |
|
|
| `OIDC_USERINFO` | Userinfo endpoint. Usually ends with `userinfo`. |
|
|
| `OIDC_SCOPES` | Comma separated list of scopes. Requires, at least, `openid` and `email`. |
|
|
|
|
## Redirect URL
|
|
|
|
Drop uses the `EXTERNAL_URL` environment variable to create the callback URL: `$EXTERNAL_URL/auth/callback/oidc`.
|