Mirrors/continuwuity
0
0 Fork 0
mirror of https://forgejo.ellis.link/continuwuation/continuwuity.git synced 2026-11-14 12:46:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(auth): Incorporate changes from PR review comments

Browse Source
This commit is contained in:
stratself authored and Ellis Git committed 2026-09-29 16:26:07 +00:00
1 parent f35eb7677c
commit f49bda81d2
2 files changed
+9 -9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/authentication/oidc.mdx
+6 -6
View File
@@ -14,7 +14,7 @@ A simple OIDC configuration is as easy as creating a new OIDC application in you
### Configuring the OIDC provider
This guide will use [**kanidm**][kanidm] as an example, but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
This guide will use [**Kanidm**][kanidm] as an example, but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
First, create a new application for Continuwuity in your identity provider.
@@ -74,11 +74,7 @@ Continuwuity offers several additional configuration options to tweak its integr
### Minting tokens for non-OIDC accounts
With OIDC delegation enabled, accounts without an OIDC mapping can still be created (via `!admin users create`), but will not be able to log in to the homeserver. To accommodate this, homeserver admins can use the [`!admin users issue-token`](../reference/admin/users#admin-users-issue-token) command to issue tokens for them. This command requires the account to have set a local password, which can be done with [`!admin users reset-password`](../reference/admin/users#admin-users-reset-password).
### Decommissioning OIDC delegation
It is possible to revert to using the internal database for authentication. First, uncomment the `[global.oauth.oidc]` section in your config file and restart the homeserver. Then, execute the [`!admin users reset-password --convert-to-local-account`](../reference/admin/users#admin-users-reset-password) for each user, to assign them a local password and convert their linked accounts into local ones.
With OIDC delegation enabled, accounts without an OIDC mapping (such as bot accounts) can still be created via the admin commands, but will not be able to log in to the homeserver. To accommodate this, homeserver admins can use the [`!admin users issue-token`](../reference/admin/users#admin-users-issue-token) command to issue tokens for them. This command requires the account to have set a local password, which can be done with [`!admin users reset-password`](../reference/admin/users#admin-users-reset-password).
### Manually linking users to OIDC claims
@@ -99,3 +95,7 @@ These associations can be changed manually with the [`!admin oidc`](../reference
("1d3fc994-3947-406d-b22c-0fc529baf235", "john")
("721c36a8-ce04-4474-8e97-b62655b07340", "jane")
```
### Decommissioning OIDC delegation
It is possible to revert to using the internal database for authentication. First, comment out the `[global.oauth.oidc]` section in your config file and restart the homeserver. Then, execute the [`!admin users reset-password --convert-to-local-account`](../reference/admin/users#admin-users-reset-password) for each user, to assign them a local password and convert their linked accounts into local ones.