Something went wrong. Try again.
AtAuth
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341/** * OIDC App Presets * * Pre-configured settings for common self-hosted applications. * Used by the setup wizard to simplify OIDC client registration. */
export interface OIDCAppPreset { /** URL-safe key used in wizard routes */ key: string; /** Display name */ name: string; /** Short description */ description: string; /** Suggested client_id */ suggested_client_id: string; /** Recommended grant types */ grant_types: string[]; /** Recommended scopes */ scopes: string[]; /** Redirect URI template -- {{DOMAIN}} is replaced by user input */ redirect_uri_template: string; /** Token endpoint auth method */ token_endpoint_auth_method: 'client_secret_basic' | 'client_secret_post' | 'none'; /** Whether PKCE should be required */ require_pkce: boolean; /** Token TTLs in seconds */ id_token_ttl_seconds: number; access_token_ttl_seconds: number; refresh_token_ttl_seconds: number; /** Setup instructions shown after client creation */ setup_notes: string;}
export const OIDC_APP_PRESETS: OIDCAppPreset[] = [ { key: 'audiobookshelf', name: 'Audiobookshelf', description: 'Audiobook and podcast server', suggested_client_id: 'audiobookshelf', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/auth/openid/callback', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'In Audiobookshelf: Settings > Authentication > OpenID.\n- Issuer URL: Your ATAuth discovery URL\n- Client ID: The client ID above\n- Client Secret: The secret above\n- Auto Launch: Enable for automatic redirect\n- Button Text: "Sign in with AT Protocol"', }, { key: 'jellyfin', name: 'Jellyfin', description: 'Media server (requires SSO plugin)', suggested_client_id: 'jellyfin', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile'], redirect_uri_template: 'https://{{DOMAIN}}/sso/OID/redirect/atauth', token_endpoint_auth_method: 'client_secret_post', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Requires the SSO Authentication plugin.\n1. Install "SSO Authentication" from the Jellyfin plugin catalog\n2. Restart Jellyfin\n3. In Dashboard > Plugins > SSO, add an OpenID provider:\n - Provider name: atauth\n - OID Discovery URL: Your ATAuth discovery URL\n - Client ID and Client Secret from above', }, { key: 'nextcloud', name: 'Nextcloud', description: 'File sync and collaboration platform', suggested_client_id: 'nextcloud', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/apps/oidc_login/oidc', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Requires the "OpenID Connect Login" app.\n1. Install from Nextcloud Apps\n2. Settings > Administration > SSO & SAML\n3. Configure:\n - Identifier: atauth\n - Client ID and Client Secret from above\n - Discovery endpoint: Your ATAuth discovery URL\n - Button display name: "ATAuth"', }, { key: 'gitea', name: 'Gitea / Forgejo', description: 'Git hosting and DevOps platform', suggested_client_id: 'gitea', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/user/oauth2/atauth/callback', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'In Site Administration > Authentication Sources:\n1. Add Authentication Source > OAuth2\n2. Authentication Name: atauth\n3. OAuth2 Provider: OpenID Connect\n4. Client ID and Client Secret from above\n5. OpenID Connect Auto Discovery URL: Your ATAuth discovery URL\n6. Save', }, { key: 'immich', name: 'Immich', description: 'Photo and video management', suggested_client_id: 'immich', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/auth/login\napp.immich:/', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'In Administration > Settings > OAuth:\n1. Enable OAuth Login\n2. Issuer URL: Your ATAuth discovery URL\n3. Client ID and Client Secret from above\n4. Scope: openid profile email\n5. Button Text: "Sign in with ATAuth"\nNote: Both web and mobile redirect URIs are registered.', }, { key: 'grafana', name: 'Grafana', description: 'Monitoring and observability dashboards', suggested_client_id: 'grafana', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/login/generic_oauth', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables (or grafana.ini):\n GF_AUTH_GENERIC_OAUTH_ENABLED=true\n GF_AUTH_GENERIC_OAUTH_NAME=ATAuth\n GF_AUTH_GENERIC_OAUTH_CLIENT_ID=grafana\n GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=<secret>\n GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email\n GF_AUTH_GENERIC_OAUTH_AUTH_URL=<issuer>/oauth/authorize\n GF_AUTH_GENERIC_OAUTH_TOKEN_URL=<issuer>/oauth/token\n GF_AUTH_GENERIC_OAUTH_API_URL=<issuer>/oauth/userinfo\n GF_AUTH_GENERIC_OAUTH_USE_PKCE=true', }, { key: 'wikijs', name: 'Wiki.js', description: 'Modern wiki engine', suggested_client_id: 'wikijs', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/login/atauth/callback', token_endpoint_auth_method: 'client_secret_basic', require_pkce: false, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'In Administration > Authentication:\n1. Add Strategy > OpenID Connect / OAuth2\n2. Client ID and Client Secret from above\n3. Authorization Endpoint URL: <issuer>/oauth/authorize\n4. Token URL: <issuer>/oauth/token\n5. User Info URL: <issuer>/oauth/userinfo\nNote: Wiki.js does not support PKCE, so it is disabled for this client.', }, { key: 'portainer', name: 'Portainer', description: 'Container management UI', suggested_client_id: 'portainer', grant_types: ['authorization_code'], scopes: ['openid', 'profile'], redirect_uri_template: 'https://{{DOMAIN}}', token_endpoint_auth_method: 'client_secret_basic', require_pkce: false, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'In Settings > Authentication > OAuth:\n1. Provider: Custom\n2. Client ID and Client Secret from above\n3. Authorization URL: <issuer>/oauth/authorize\n4. Access Token URL: <issuer>/oauth/token\n5. Resource URL: <issuer>/oauth/userinfo\n6. Redirect URL: https://your-portainer-domain\n7. Scopes: openid profile', }, { key: 'outline', name: 'Outline', description: 'Team knowledge base and wiki', suggested_client_id: 'outline', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/auth/oidc.callback', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables:\n OIDC_CLIENT_ID=outline\n OIDC_CLIENT_SECRET=<secret>\n OIDC_AUTH_URI=<issuer>/oauth/authorize\n OIDC_TOKEN_URI=<issuer>/oauth/token\n OIDC_USERINFO_URI=<issuer>/oauth/userinfo\n OIDC_DISPLAY_NAME=ATAuth\n OIDC_SCOPES=openid profile email', }, { key: 'mealie', name: 'Mealie', description: 'Recipe management and meal planning', suggested_client_id: 'mealie', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/login', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables:\n OIDC_AUTH_ENABLED=true\n OIDC_CLIENT_ID=mealie\n OIDC_CLIENT_SECRET=<secret>\n OIDC_CONFIGURATION_URL=<issuer>/.well-known/openid-configuration\n OIDC_SIGNUP_ENABLED=true\n OIDC_PROVIDER_NAME=ATAuth', }, { key: 'paperless-ngx', name: 'Paperless-ngx', description: 'Document management system', suggested_client_id: 'paperless', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/accounts/oidc/atauth/login/callback/', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables:\n PAPERLESS_APPS=allauth.socialaccount.providers.openid_connect\n PAPERLESS_SOCIALACCOUNT_PROVIDERS=\'{"openid_connect":{"SCOPE":["openid","profile","email"],"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"atauth","name":"ATAuth","client_id":"<client_id>","secret":"<secret>","settings":{"server_url":"<issuer>","token_auth_method":"client_secret_basic"}}]}}\'\nOptional:\n PAPERLESS_SOCIAL_AUTO_SIGNUP=true\n PAPERLESS_REDIRECT_LOGIN_TO_SSO=true\nRequires Paperless-ngx v2.5.0+.', }, { key: 'vaultwarden', name: 'Vaultwarden', description: 'Bitwarden-compatible password manager', suggested_client_id: 'vaultwarden', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/identity/connect/oidc-signin', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables:\n SSO_ENABLED=true\n SSO_AUTHORITY=<issuer> (no trailing slash, no .well-known)\n SSO_CLIENT_ID=vaultwarden\n SSO_CLIENT_SECRET=<secret>\nOptional:\n SSO_ONLY=true (disable password login)\nNote: Master password is still required even with SSO enabled.', }, { key: 'miniflux', name: 'Miniflux', description: 'Minimalist RSS reader', suggested_client_id: 'miniflux', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/oauth2/oidc/callback', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables:\n OAUTH2_PROVIDER=oidc\n OAUTH2_CLIENT_ID=miniflux\n OAUTH2_CLIENT_SECRET=<secret>\n OAUTH2_REDIRECT_URL=https://your-domain/oauth2/oidc/callback\n OAUTH2_OIDC_DISCOVERY_ENDPOINT=<issuer> (no .well-known suffix)\n OAUTH2_OIDC_PROVIDER_NAME=ATAuth\n OAUTH2_USER_CREATION=1', }, { key: 'mattermost', name: 'Mattermost', description: 'Team messaging platform', suggested_client_id: 'mattermost', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/signup/openid/complete', token_endpoint_auth_method: 'client_secret_post', require_pkce: false, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'In System Console > Authentication > OpenID Connect:\n1. Select "OpenID Connect (Other)"\n2. Discovery Endpoint: <issuer>/.well-known/openid-configuration\n3. Client ID and Client Secret from above\n4. Button Name: ATAuth\nRequires Mattermost Enterprise, Professional, or Entry edition.\nTeam Edition: Use GitLab SSO path instead (/signup/gitlab/complete) with GitLabSettings in config.json.', }, { key: 'vikunja', name: 'Vikunja', description: 'Task and project management', suggested_client_id: 'vikunja', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/auth/openid/atauth', token_endpoint_auth_method: 'client_secret_basic', require_pkce: false, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables:\n VIKUNJA_AUTH_OPENID_ENABLED=true\n VIKUNJA_AUTH_OPENID_PROVIDERS_ATAUTH_NAME=ATAuth\n VIKUNJA_AUTH_OPENID_PROVIDERS_ATAUTH_AUTHURL=<issuer>\n VIKUNJA_AUTH_OPENID_PROVIDERS_ATAUTH_CLIENTID=vikunja\n VIKUNJA_AUTH_OPENID_PROVIDERS_ATAUTH_CLIENTSECRET=<secret>\nOr in config.yml under auth.openid.providers.atauth.', }, { key: 'plane', name: 'Plane', description: 'Project management and issue tracking', suggested_client_id: 'plane', grant_types: ['authorization_code'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/auth/oidc/callback/', token_endpoint_auth_method: 'client_secret_post', require_pkce: false, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'In God Mode (/god-mode/authentication/oidc/):\n1. Client ID and Client Secret from above\n2. Authorize URL: <issuer>/oauth/authorize\n3. Token URL: <issuer>/oauth/token\n4. User Info URL: <issuer>/oauth/userinfo\nNote: Plane does not support OIDC Discovery -- you must enter each endpoint URL manually. Trailing slashes on redirect URIs are required.', }, { key: 'gotosocial', name: 'GoToSocial', description: 'Lightweight fediverse server', suggested_client_id: 'gotosocial', grant_types: ['authorization_code'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/auth/callback', token_endpoint_auth_method: 'client_secret_basic', require_pkce: false, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'In config.yaml:\n oidc-enabled: true\n oidc-idp-name: ATAuth\n oidc-issuer: <issuer>\n oidc-client-id: gotosocial\n oidc-client-secret: <secret>\n oidc-scopes:\n - openid\n - email\n - profile', }, { key: 'stirling-pdf', name: 'Stirling-PDF', description: 'PDF manipulation toolkit', suggested_client_id: 'stirling-pdf', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/login/oauth2/code/atauth', token_endpoint_auth_method: 'client_secret_basic', require_pkce: false, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables:\n SECURITY_ENABLELOGIN=true\n SECURITY_OAUTH2_ENABLED=true\n SECURITY_OAUTH2_ISSUER=<issuer> (no .well-known suffix)\n SECURITY_OAUTH2_CLIENTID=stirling-pdf\n SECURITY_OAUTH2_CLIENTSECRET=<secret>\n SECURITY_OAUTH2_PROVIDER=atauth\n SECURITY_OAUTH2_SCOPES=openid, profile, email\n SECURITY_OAUTH2_USEASUSERNAME=preferred_username', }, { key: 'tandoor', name: 'Tandoor Recipes', description: 'Recipe management and meal planning', suggested_client_id: 'tandoor', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/accounts/oidc/atauth/login/callback/', token_endpoint_auth_method: 'client_secret_basic', require_pkce: true, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables:\n SOCIAL_PROVIDERS=allauth.socialaccount.providers.openid_connect\n SOCIALACCOUNT_PROVIDERS=\'{"openid_connect":{"OAUTH_PKCE_ENABLED":true,"APPS":[{"provider_id":"atauth","name":"ATAuth","client_id":"<client_id>","secret":"<secret>","settings":{"server_url":"<issuer>/.well-known/openid-configuration"}}]}}\'\nUses the same django-allauth pattern as Paperless-ngx.', }, { key: 'freshrss', name: 'FreshRSS', description: 'RSS feed aggregator', suggested_client_id: 'freshrss', grant_types: ['authorization_code', 'refresh_token'], scopes: ['openid', 'profile', 'email'], redirect_uri_template: 'https://{{DOMAIN}}/i/oidc/', token_endpoint_auth_method: 'client_secret_basic', require_pkce: false, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 604800, setup_notes: 'Set these environment variables:\n OIDC_ENABLED=1\n OIDC_PROVIDER_METADATA_URL=<issuer>/.well-known/openid-configuration\n OIDC_CLIENT_ID=freshrss\n OIDC_CLIENT_SECRET=<secret>\n OIDC_CLIENT_CRYPTO_KEY=<random-string> (session encryption key)\n OIDC_REMOTE_USER_CLAIM=preferred_username\n OIDC_SCOPES=openid email profile\nBehind reverse proxy, add:\n OIDC_X_FORWARDED_HEADERS=X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto\nNote: Select "HTTP Authentication" during initial FreshRSS setup. Create the default user with the same username as your OIDC identity.', },];
export function getPresetByKey(key: string): OIDCAppPreset | undefined { return OIDC_APP_PRESETS.find(p => p.key === key);}