mirror of
https://forgejo.ellis.link/continuwuation/continuwuity.git
synced 2026-11-13 12:16:54 +00:00
74 lines
3.3 KiB
Plaintext
74 lines
3.3 KiB
Plaintext
# Configuring delegated authentication
|
|
|
|
Continuwuity supports delegating user authentication to an external identity provider that implements the OpenID Connect specification, such as Authentik, kanidm, or Keycloak.
|
|
|
|
:::important Delegated authentication and legacy logins
|
|
When delegated authentication is configured, Continuwuity will disable its support for legacy logins. **Only clients that support OAuth** will be able to login.
|
|
:::
|
|
|
|
## Instructions
|
|
|
|
A simple OIDC configuration is as easy as creating a new OIDC application in your identity provider's settings and supplying Continuwuity with the client ID and client secret.
|
|
|
|
### Configuring the OIDC provider
|
|
|
|
This guide will use [**kanidm**][kanidm] as an example, but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
|
|
|
|
First, create a new application for Continuwuity in your identity provider.
|
|
|
|
```sh
|
|
# Here, `c10y` is the client ID that kanidm will use, and `Continuwuity` is the display name.
|
|
# Other identity providers may generate a client ID for you.
|
|
# Use the domain that clients can reach Continuwuity at, which may not be the same as your server name
|
|
# if you have configured well-known delegation.
|
|
kanidm system oauth2 create c10y Continuwuity https://matrix.yourdomain.com
|
|
```
|
|
|
|
Configure the redirect URL that Continuwuity uses.
|
|
|
|
```sh
|
|
kanidm system oauth2 add-redirect-url c10y https://matrix.yourdomain.com/_continuwuity/oidc/complete
|
|
```
|
|
|
|
Allow Continuwuity to request the `openid` scope. Other identity providers may not require this step.
|
|
|
|
```sh
|
|
kanidm system oauth2 update-scope-map c10y idm_all_persons openid
|
|
```
|
|
|
|
Find the client secret that was generated. Other identity providers may show this information in their web UI.
|
|
```sh
|
|
kanidm system oauth2 show-basic-secret c10y
|
|
d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr
|
|
```
|
|
|
|
[kanidm]: https://kanidm.com
|
|
|
|
### Configuring Continuwuity
|
|
|
|
Configure Continuwuity with the client ID, client secret, and discovery URL. kanidm has a different discovery URL for each client, but other identity providers may have a single discovery URL at the root of their domain.
|
|
|
|
```toml
|
|
[global.oauth.oidc]
|
|
|
|
# `/.well-known/openid-configuration` will be appended automatically
|
|
discovery_url = "https://idm.example.com/oauth2/openid/c10y"
|
|
|
|
# This may be randomly generated by your identity provider. kanidm requires
|
|
# you to set it manually when you create the application.
|
|
client_id = "c10y"
|
|
|
|
# From the previous step
|
|
client_secret = "d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr"
|
|
```
|
|
|
|
### Testing that it works
|
|
|
|
Finally, restart Continuwuity, and log out and back in again. Your client should prompt you to continue in your web browser and open a webpage with the Continuwuity logo that allows you to continue in your identity provider. Once you log in successfully there, you will be prompted to choose a user ID -- to link your existing account, enter its user ID, and then your old password.
|
|
|
|
Continuwuity offers several additional configuration options to tweak its integration with your identity provider. Review the `[global.oauth.oidc]` section towards the bottom of the [reference configuration](../reference/config) for a complete list of options and documentation.
|
|
|
|
{/* TODO: Section on OIDC decommissioning */}
|
|
|
|
{/* TODO: Section on minting tokens */}
|