From e8593eeaca53d99d336a64de53799c569510f8d2 Mon Sep 17 00:00:00 2001
From: Freek <git@freekhoekstra.nl>
Date: Mon, 12 Oct 2026 19:40:38 +0200
Subject: [PATCH] docs(oidc): Add Authelia to OIDC instructions

---
 docs/authentication/oidc.mdx | 54 +++++++++++++++++++++++++++++++++---
 1 file changed, 50 insertions(+), 4 deletions(-)

diff --git a/docs/authentication/oidc.mdx b/docs/authentication/oidc.mdx
index 815d60af2..6c2dad3bc 100644
--- a/docs/authentication/oidc.mdx
+++ b/docs/authentication/oidc.mdx
@@ -14,7 +14,9 @@ A simple OIDC configuration is as easy as creating a new OIDC application in you
 
 ### Configuring the OIDC provider
 
-This guide will use [**Kanidm**][kanidm] as an example, but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
+This guide will cover [**Kanidm**][kanidm] and [**Authelia**][authelia], but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
+
+#### KanIDM
 
 First, create a new application for Continuwuity in your identity provider.
 
@@ -46,6 +48,50 @@ d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr
 
 [kanidm]: https://kanidm.com
 
+#### Authelia
+
+These instructions assume you have already set up Authelia as an OIDC provider and are just adding Continuwuity to it. If you are looking how to set up your Authelia as an OIDC provider, [this article](https://blog.stonegarden.dev/articles/2025/06/authelia-oidc/) is very useful.
+To create a new client in your identity provider, it is [recommended](https://www.authelia.com/integration/openid-connect/frequently-asked-questions/#how-do-i-generate-a-client-identifier-or-client-secret) to randomly generate both the client id and client secret. The commands below should get you those:
+
+```sh
+# Generate client ID:
+authelia crypto rand --length 72 --charset rfc3986
+# or using Docker:
+docker run --rm authelia/authelia:latest authelia crypto rand --length 72 --charset rfc3986
+```
+
+Generate the client secret (shown as password in output) and its digest:
+```sh
+authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
+# or using Docker:
+docker run --rm authelia/authelia:latest authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
+```
+
+Authelia only needs to know the digest (hash) of the secret, whereas Continuwuity requires the secret itself.
+
+Also note the domain that clients can reach Continuwuity at, which may not be the same as your server name if you have configured well-known delegation. In this example, we will use `https://matrix.yourdomain.com` for that (your server name in this case may be `yourdomain.com`).
+
+Now we have everything we need to add Continuwuity to Authelia's OIDC client configuration. Go to your Authelia configuration file, find the `identity_provers` block, and add to the `clients` list:
+
+```yaml
+identity_providers:
+  oidc:
+    jwks:
+       # This part has the JWKs and is what you configured previously
+       [...]
+    clients:
+      # Add this block below
+      - client_name: continuwuity
+        client_id: "client-id-goes-here"
+        client_secret: "client-secret-DIGEST-goes-here"
+        redirect_uris: ["https://matrix.yourdomain.com/_continuwuity/oidc/complete"]
+        scopes: [openid]
+```
+
+The discovery URL that continuwuity can use with Authelia is simply the root domain at which your Authelia can be reached by clients, which should be something like `https://authelia.example.com`.
+
+[authelia]: https://www.authelia.com
+
 ### Configuring Continuwuity
 
 Configure Continuwuity with the client ID, client secret, and discovery URL provided from the steps above. Kanidm has a different discovery URL for each client, but other identity providers may have a single discovery URL at the root of their domain.
@@ -54,10 +100,10 @@ Configure Continuwuity with the client ID, client secret, and discovery URL prov
 [global.oauth.oidc]
 
 # `/.well-known/openid-configuration` will be appended automatically
-discovery_url = "https://idm.example.com/oauth2/openid/c10y"
+# Choose the appropriate option from below, not both
+discovery_url = "https://idm.example.com/oauth2/openid/c10y" # For KanIDM
+discovery_url = "https://authelia.example.com/" # For Authelia
 
-# This may be randomly generated by your identity provider. Kanidm requires
-# you to set it manually when you create the application.
 client_id = "c10y"
 
 # From the previous step