docs(auth): Copy stuff from the OIDC guide

The guide would be removed at a later time

docs/authentication/_meta.json

@@ -7,6 +7,6 @@
     {
         "type": "file",
         "name": "oidc",
-        "label": "OIDC Delegated authentication"
+        "label": "Delegated authentication (OIDC)"
     }
 ]

docs/authentication/oidc.mdx

@@ -1,3 +1,63 @@
-# OIDC delegated authentication
+# Configuring delegated authentication
 
-{/* TODO: copy stuff over from guides/oidc.mdx and refactor */}
+Continuwuity supports delegating user authentication to an external identity provider that implements the OpenID Connect specification, such as Authentik, kanidm, or Keycloak.
+
+## Instructions
+
+A simple OIDC configuration is as easy as creating a new OIDC application in your identity provider's settings and supplying Continuwuity with the client ID and client secret.
+
+### Configuring the OIDC provider
+
+This guide will use [**kanidm**][kanidm] as an example, but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
+
+First, create a new application for Continuwuity in your identity provider.
+
+```sh
+# Here, `c10y` is the client ID that kanidm will use, and `Continuwuity` is the display name.
+# Other identity providers may generate a client ID for you.
+# Use the domain that clients can reach Continuwuity at, which may not be the same as your server name
+# if you have configured well-known delegation.
+kanidm system oauth2 create c10y Continuwuity https://matrix.yourdomain.com
+```
+
+Configure the redirect URL that Continuwuity uses.
+
+```sh
+kanidm system oauth2 add-redirect-url c10y https://matrix.yourdomain.com/_continuwuity/oidc/complete
+```
+
+Allow Continuwuity to request the `openid` scope. Other identity providers may not require this step.
+
+```sh
+kanidm system oauth2 update-scope-map c10y idm_all_persons openid
+```
+
+Find the client secret that was generated. Other identity providers may show this information in their web UI.
+```sh
+kanidm system oauth2 show-basic-secret c10y
+d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr
+```
+
+[kanidm]: https://kanidm.com
+
+### Configuring Continuwuity
+
+Configure Continuwuity with the client ID, client secret, and discovery URL. kanidm has a different discovery URL for each client, but other identity providers may have a single discovery URL at the root of their domain.
+
+```toml
+[global.oauth.oidc]
+
+# `/.well-known/openid-configuration` will be appended automatically
+discovery_url = "https://idm.example.com/oauth2/openid/c10y"
+
+# This may be randomly generated by your identity provider. kanidm requires
+# you to set it manually when you create the application.
+client_id = "c10y"
+
+# From the previous step
+client_secret = "d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr"
+```
+
+Finally, restart Continuwuity, and log out and back in again. Your client should prompt you to continue in your web browser and open a webpage with the Continuwuity logo that allows you to continue in your identity provider. Once you log in successfully, you will be prompted to choose a user ID -- to link your existing account, enter its user ID, and then your old password when prompted.
+
+Continuwuity offers several additional configuration options to tweak its integration with your identity provider. Review the `[global.oauth.oidc]` section towards the bottom of the [reference configuration](../reference/config) for a complete list of options and documentation.