Mirrors/continuwuity
0
0 Fork 0
mirror of https://forgejo.ellis.link/continuwuation/continuwuity.git synced 2026-11-12 19:56:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(auth): Incorporate changes from PR review comments

Browse Source
This commit is contained in:
stratself authored and Ellis Git committed 2026-09-29 16:26:07 +00:00
1 parent f35eb7677c
commit f49bda81d2
2 files changed
+9 -9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/authentication/internal.mdx
+3 -3
View File
@@ -4,20 +4,20 @@ Continuwuity comes with an internal database for user authentication, which it u
## Registration
Registration is disabled by default. To enable it, set `allow_registration = true` in your config file and configure at least one of the registration methods below.
Registration is disabled by default. To enable it, set `allow_registration = true` in your config file and use at least one of the registration methods below.
| Method | Description | Additional configuration needed |
| ------ | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| 1 | Admin-issued tokens (recommended) | None. Use the [`!admin token issue`](../reference/admin/token#admin-token-issue) command |
| 2 | Static registration token | `registration_token` or `registration_token_file` |
| 3 | reCAPTCHA-only registration | `recaptcha_site_key` and `recaptcha_private_site_key` |
| 4 | Email only registration | `require_email_for_registration = true` in `[global.smtp]` section. See [Email configuration](#email-configuration) |
| 4 | Email-only registration | `require_email_for_registration = true` in `[global.smtp]` section. See [Email configuration](#email-configuration) |
| 5 | Static token + reCAPTCHA | Methods 2 + 3 |
| 6 | Email + reCAPTCHA | Methods 3 + 4 |
| 7 | Static token + email | Method 2 + `require_email_for_token_registration = true` in `[global.smtp]`. See [Email configuration](#email-configuration) |
| 8 | Static token + email + reCAPTCHA | Methods 3 + 7 |
Users can register on Continuwiity's account management page, or directly within a Matrix client if legacy login is enabled.
Users can register on Continuwuity's account management page, or directly within a Matrix client if legacy login is enabled.
Admin-issued tokens are the recommended method of registration. These tokens can be scoped with an expiry duration or maximum times used, and are suited for private/invite-only homeservers. See the [`!admin token`](../reference/admin/token) commands for more details.
docs/authentication/oidc.mdx
+6 -6
View File
@@ -14,7 +14,7 @@ A simple OIDC configuration is as easy as creating a new OIDC application in you
### Configuring the OIDC provider
This guide will use [**kanidm**][kanidm] as an example, but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
This guide will use [**Kanidm**][kanidm] as an example, but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
First, create a new application for Continuwuity in your identity provider.
@@ -74,11 +74,7 @@ Continuwuity offers several additional configuration options to tweak its integr
### Minting tokens for non-OIDC accounts
With OIDC delegation enabled, accounts without an OIDC mapping can still be created (via `!admin users create`), but will not be able to log in to the homeserver. To accommodate this, homeserver admins can use the [`!admin users issue-token`](../reference/admin/users#admin-users-issue-token) command to issue tokens for them. This command requires the account to have set a local password, which can be done with [`!admin users reset-password`](../reference/admin/users#admin-users-reset-password).
### Decommissioning OIDC delegation
It is possible to revert to using the internal database for authentication. First, uncomment the `[global.oauth.oidc]` section in your config file and restart the homeserver. Then, execute the [`!admin users reset-password --convert-to-local-account`](../reference/admin/users#admin-users-reset-password) for each user, to assign them a local password and convert their linked accounts into local ones.
With OIDC delegation enabled, accounts without an OIDC mapping (such as bot accounts) can still be created via the admin commands, but will not be able to log in to the homeserver. To accommodate this, homeserver admins can use the [`!admin users issue-token`](../reference/admin/users#admin-users-issue-token) command to issue tokens for them. This command requires the account to have set a local password, which can be done with [`!admin users reset-password`](../reference/admin/users#admin-users-reset-password).
### Manually linking users to OIDC claims
@@ -99,3 +95,7 @@ These associations can be changed manually with the [`!admin oidc`](../reference
("1d3fc994-3947-406d-b22c-0fc529baf235", "john")
("721c36a8-ce04-4474-8e97-b62655b07340", "jane")
```
### Decommissioning OIDC delegation
It is possible to revert to using the internal database for authentication. First, comment out the `[global.oauth.oidc]` section in your config file and restart the homeserver. Then, execute the [`!admin users reset-password --convert-to-local-account`](../reference/admin/users#admin-users-reset-password) for each user, to assign them a local password and convert their linked accounts into local ones.