authelia/docs/configuration/identity-providers/oidc.md

layout	title	parent	grand_parent	nav_order
default	OpenID Connect	Identity Providers	Configuration	2

OpenID Connect

Authelia currently supports the OpenID Connect OP role as a beta feature. The OP role is the OpenID Connect Provider role, not the Relaying Party or RP role. This means other applications that implement the OpenID Connect RP role can use Authelia as an authentication and authorization backend similar to how you may use social media or development platforms for login.

The Relaying Party role is the role which allows an application to use GitHub, Google, or other OpenID Connect providers for authentication and authorization. We do not intend to support this functionality at this moment in time.

Beta

We have decided to implement OpenID Connect as a beta feature, it's suggested you only utilize it for testing and providing feedback, and should take caution in relying on it in production. OpenID Connect and it's related endpoints are not enabled by default unless you specifically configure the OpenID Connect section.

The beta will be broken up into stages. Each stage will bring additional features. The following table is a rough plan for which stage will have each feature, and may evolve over time:

Stage	Feature Description
beta1	User Consent
	Authorization Code Flow
	OpenID Connect Discovery
	RS256 Signature Strategy
	Per Client Scope/Grant Type/Response Type Restriction
	Per Client Authorization Policy (1FA/2FA)
	Per Client List of Valid Redirection URI's
beta2 1	Token Storage
	Audit Storage
beta3 1	Back-Channel Logout
	Deny Refresh on Session Expiration
	Signing Key Rotation Policy
	Client Secrets Hashed in Configuration
GA 1	General Availability after previous stages are vetted for bug fixes
misc	List of other features that may be implemented
	Front-Channel Logout 2

¹ this stage has not been implemented as of yet

² this individual feature has not been implemented as of yet

Configuration

identity_providers:
  oidc:
    hmac_secret: this_is_a_secret_abc123abc123abc
    issuer_private_key: |
      --- KEY START
      --- KEY END      
    clients:
      - id: myapp
        description: My Application
        secret: this_is_a_secret
        authorization_policy: two_factor
        redirect_uris:
          - https://oidc.example.com:8080/oauth2/callback
        scopes:
          - openid
          - groups
          - email
          - profile
        grant_types:
          - refresh_token
          - authorization_code
        response_types:
          - code

Options

hmac_secret

The HMAC secret used to sign the OpenID Connect JWT's. The provided string is hashed to a SHA256 byte string for the purpose of meeting the required format.

Can also be defined using a secret which is the recommended for containerized deployments.

issuer_private_key

The private key in DER base64 encoded PEM format used to encrypt the OpenID Connect JWT's.

Can also be defined using a secret which is the recommended for containerized deployments.

clients

A list of clients to configure. The options for each client are described below.

id

The Client ID for this client. Must be configured in the application consuming this client.

description

A friendly description for this client shown in the UI. This defaults to the same as the ID.

secret

The shared secret between Authelia and the application consuming this client. Currently this is stored in plain text.

authorization_policy

The authorization policy for this client. Either one_factor or two_factor.

redirect_uris

A list of valid callback URL's this client will redirect to. All other callbacks will be considered unsafe. The URL's are case-sensitive.

scopes

A list of scopes to allow this client to consume. See scope definitions for more information.

grant_types

A list of grant types this client can return. It is recommended that this isn't configured at this time unless you know what you're doing.

response_types

A list of response types this client can return. It is recommended that this isn't configured at this time unless you know what you're doing.

Scope Definitions

openid

This is the default scope for openid. This field is forced on every client by the configuration validation that Authelia does.

JWT Field	JWT Type	Authelia Attribute	Description
sub	string	Username	The username the user used to login with
scope	string	scopes	Granted scopes (space delimited)
scp	array[string]	scopes	Granted scopes
iss	string	hostname	The issuer name, determined by URL
at_hash	string	N/A	Access Token Hash
auth_time	number	N/A	Authorize Time
aud	array[string]	N/A	Audience
exp	number	N/A	Expires
iat	number	N/A	Issued At
rat	number	N/A	Requested At
jti	string(uuid)	N/A	JWT Identifier

groups

This scope includes the groups the authentication backend reports the user is a member of in the token.

JWT Field	JWT Type	Authelia Attribute	Description
groups	array[string]	Groups	The users display name

email

This scope includes the email information the authentication backend reports about the user in the token.

JWT Field	JWT Type	Authelia Attribute	Description
email	string	email[0]	The first email in the list of emails
email_verified	bool	N/A	If the email is verified, assumed true for the time being

profile

This scope includes the profile information the authentication backend reports about the user in the token.

JWT Field	JWT Type	Authelia Attribute	Description
name	string	display_name	The users display name