From 516f94d83f0d7385b718810f1af5257264a0dd55 Mon Sep 17 00:00:00 2001
From: stratself <stratself@noreply.forgejo.ellis.link>
Date: Sat, 12 Sep 2026 05:53:59 +0000
Subject: [PATCH] docs(auth): Copy stuff from the OIDC guide

The guide would be removed at a later time
---
 docs/authentication/_meta.json |  2 +-
 docs/authentication/oidc.mdx   | 64 ++++++++++++++++++++++++++++++++--
 2 files changed, 63 insertions(+), 3 deletions(-)

diff --git a/docs/authentication/_meta.json b/docs/authentication/_meta.json
index ad0593a01..1224bfce5 100644
--- a/docs/authentication/_meta.json
+++ b/docs/authentication/_meta.json
@@ -7,6 +7,6 @@
     {
         "type": "file",
         "name": "oidc",
-        "label": "OIDC Delegated authentication"
+        "label": "Delegated authentication (OIDC)"
     }
 ]
diff --git a/docs/authentication/oidc.mdx b/docs/authentication/oidc.mdx
index 3fe6343e1..1d053c2fc 100644
--- a/docs/authentication/oidc.mdx
+++ b/docs/authentication/oidc.mdx
@@ -1,3 +1,63 @@
-# OIDC delegated authentication
+# Configuring delegated authentication
 
-{/* TODO: copy stuff over from guides/oidc.mdx and refactor */}
\ No newline at end of file
+Continuwuity supports delegating user authentication to an external identity provider that implements the OpenID Connect specification, such as Authentik, kanidm, or Keycloak.
+
+## Instructions
+
+A simple OIDC configuration is as easy as creating a new OIDC application in your identity provider's settings and supplying Continuwuity with the client ID and client secret.
+
+### Configuring the OIDC provider
+
+This guide will use [**kanidm**][kanidm] as an example, but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
+
+First, create a new application for Continuwuity in your identity provider.
+
+```sh
+# Here, `c10y` is the client ID that kanidm will use, and `Continuwuity` is the display name.
+# Other identity providers may generate a client ID for you.
+# Use the domain that clients can reach Continuwuity at, which may not be the same as your server name
+# if you have configured well-known delegation.
+kanidm system oauth2 create c10y Continuwuity https://matrix.yourdomain.com
+```
+
+Configure the redirect URL that Continuwuity uses.
+
+```sh
+kanidm system oauth2 add-redirect-url c10y https://matrix.yourdomain.com/_continuwuity/oidc/complete
+```
+
+Allow Continuwuity to request the `openid` scope. Other identity providers may not require this step.
+
+```sh
+kanidm system oauth2 update-scope-map c10y idm_all_persons openid
+```
+
+Find the client secret that was generated. Other identity providers may show this information in their web UI.
+```sh
+kanidm system oauth2 show-basic-secret c10y
+d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr
+```
+
+[kanidm]: https://kanidm.com
+
+### Configuring Continuwuity
+
+Configure Continuwuity with the client ID, client secret, and discovery URL. kanidm has a different discovery URL for each client, but other identity providers may have a single discovery URL at the root of their domain.
+
+```toml
+[global.oauth.oidc]
+
+# `/.well-known/openid-configuration` will be appended automatically
+discovery_url = "https://idm.example.com/oauth2/openid/c10y"
+
+# This may be randomly generated by your identity provider. kanidm requires
+# you to set it manually when you create the application.
+client_id = "c10y"
+
+# From the previous step
+client_secret = "d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr"
+```
+
+Finally, restart Continuwuity, and log out and back in again. Your client should prompt you to continue in your web browser and open a webpage with the Continuwuity logo that allows you to continue in your identity provider. Once you log in successfully, you will be prompted to choose a user ID -- to link your existing account, enter its user ID, and then your old password when prompted.
+
+Continuwuity offers several additional configuration options to tweak its integration with your identity provider. Review the `[global.oauth.oidc]` section towards the bottom of the [reference configuration](../reference/config) for a complete list of options and documentation.