Skip to content

Commit 8a972db

Browse files
jmattheisjmattheis
committed
fix: oidc
1 parent cf61685 commit 8a972db

3 files changed

Lines changed: 145 additions & 14 deletions

File tree

‎.vitepress/config.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ export default defineConfig({
2828
{text: 'Intro', link: '/docs/'},
2929
{text: 'Installation', link: '/docs/install'},
3030
{text: 'Configuration', link: '/docs/config'},
31+
{text: 'OpenID Connect (OIDC)', link: '/docs/oidc'},
3132
{text: 'First Login', link: '/docs/first-login'},
3233
{text: 'Push messages', link: '/docs/pushmsg'},
3334
{text: 'Message Extras', link: '/docs/msgextras'},

‎docs/config.md‎

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -40,33 +40,45 @@ server:
4040
enabled: false # if the certificate should be requested from letsencrypt
4141
accepttos: false # if you accept the tos from letsencrypt
4242
cache: data/certs # the directory of the cache from letsencrypt
43+
directoryurl: # override the directory url of the ACME server
44+
# Let's Encrypt highly recommend testing against their staging environment before using their production environment.
45+
# Staging server has high rate limits for testing and debugging, issued certificates are not valid
46+
# example: https://acme-staging-v02.api.letsencrypt.org/directory
4347
hosts: # the hosts for which letsencrypt should request certificates
44-
# - mydomain.tld
45-
# - myotherdomain.tld
48+
# - mydomain.tld
49+
# - myotherdomain.tld
4650
responseheaders: # response headers are added to every response (default: none)
47-
# X-Custom-Header: "custom value"
51+
# X-Custom-Header: "custom value"
52+
4853
trustedproxies: # IPs or IP ranges of trusted proxies. Used to obtain the remote ip via the X-Forwarded-For header. (configure 127.0.0.1 to trust sockets)
49-
# - 127.0.0.1
50-
# - 192.168.178.0/24
54+
# - 127.0.0.1/32
5155
# - ::1
56+
securecookie: true # If the secure flag should be set on cookies. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#secure
5257

5358
cors: # Sets cors headers only when needed and provides support for multiple allowed origins. Overrides Access-Control-* Headers in response headers.
5459
alloworigins:
55-
# - ".+.example.com"
56-
# - "otherdomain.com"
60+
# - ".+.example.com"
61+
# - "otherdomain.com"
5762
allowmethods:
58-
# - "GET"
59-
# - "POST"
63+
# - "GET"
64+
# - "POST"
6065
allowheaders:
61-
# - "Authorization"
62-
# - "content-type"
63-
66+
# - "Authorization"
67+
# - "content-type"
6468
stream:
6569
pingperiodseconds: 45 # the interval in which websocket pings will be sent. Only change this value if you know what you are doing.
66-
allowedorigins: # allowed origins for websocket connections (same origin is always allowed, default only same origin)
70+
allowedorigins: # allowed origins for websocket connections (same origin is always allowed)
6771
# - ".+.example.com"
6872
# - "otherdomain.com"
69-
database: # see below
73+
oidc:
74+
enabled: false # Enable OpenID Connect login, allowing users to authenticate via an external identity provider (e.g. Keycloak, Authelia, Google).
75+
issuer: # The OIDC issuer URL. This is the base URL of your identity provider, used to discover endpoints. Example: "https://auth.example.com/realms/myrealm"
76+
clientid: # The client ID registered with your identity provider for this application.
77+
clientsecret: # The client secret for the registered client.
78+
redirecturl: http://gotify.example.org/auth/oidc/callback # The callback URL that the identity provider redirects to after authentication. Must match exactly what is configured in your identity provider.
79+
autoregister: true # If true, automatically create a new user on first OIDC login. If false, only existing users can log in via OIDC.
80+
81+
database: # for database see (configure database section)
7082
dialect: sqlite3
7183
connection: data/gotify.db
7284
defaultuser: # on database creation, gotify creates an admin user (these values will only be used for the first start, if you want to edit the user after the first start use the WebUI)
@@ -135,4 +147,10 @@ GOTIFY_PASSSTRENGTH=10
135147
GOTIFY_UPLOADEDIMAGESDIR=data/images
136148
GOTIFY_PLUGINSDIR=data/plugins
137149
GOTIFY_REGISTRATION=false
150+
GOTIFY_OIDC_ENABLED=false
151+
GOTIFY_OIDC_ISSUER=
152+
GOTIFY_OIDC_CLIENTID=
153+
GOTIFY_OIDC_CLIENTSECRET=
154+
GOTIFY_OIDC_REDIRECTURL=http://gotify.example.org/auth/oidc/callback
155+
GOTIFY_OIDC_AUTOREGISTER=true
138156
```

‎docs/oidc.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# OpenID Connect (OIDC)
2+
3+
[[toc]]
4+
5+
Gotify supports OpenID Connect for Single Sign-On (SSO), allowing users to authenticate via an external identity provider such as Authelia or Dex.
6+
7+
::: warning
8+
The identity provider **must** support [PKCE](https://oauth.net/2/pkce/) (Proof Key for Code Exchange). IdPs without PKCE support are currently unsupported.
9+
:::
10+
11+
## Configuration
12+
13+
| Key | Description |
14+
| :------------- | :--------------------------------------------------------------------------------------------------------- |
15+
| `enabled` | Enable OIDC login. |
16+
| `issuer` | The OIDC issuer URL. Used to discover endpoints via `/.well-known/openid-configuration`. |
17+
| `clientid` | The client ID registered with your identity provider. |
18+
| `clientsecret` | The client secret. May be omitted if using a public client with PKCE. |
19+
| `redirecturl` | The callback URL the identity provider redirects to after authentication. Must match your provider config. |
20+
| `autoregister` | Automatically create a new Gotify user on first OIDC login. |
21+
22+
::: details Gotify configuration (config.yml)
23+
24+
```yml
25+
oidc:
26+
enabled: true
27+
issuer: https://auth.example.org
28+
clientid: gotify
29+
clientsecret: YOUR_CLIENT_SECRET
30+
redirecturl: https://gotify.example.org/auth/oidc/callback
31+
autoregister: true
32+
```
33+
34+
:::
35+
36+
::: details Gotify configuration via environment variables
37+
38+
```bash
39+
GOTIFY_OIDC_ENABLED=true
40+
GOTIFY_OIDC_ISSUER=https://auth.example.org
41+
GOTIFY_OIDC_CLIENTID=gotify
42+
GOTIFY_OIDC_CLIENTSECRET=YOUR_CLIENT_SECRET
43+
GOTIFY_OIDC_REDIRECTURL=https://gotify.example.org/auth/oidc/callback
44+
GOTIFY_OIDC_AUTOREGISTER=true
45+
```
46+
47+
:::
48+
49+
See the [Configuration](/docs/config) page for the full config reference.
50+
51+
### Redirect URL
52+
53+
- The redirect URL must always end with `/auth/oidc/callback`.
54+
- If Gotify is served at the root, the redirect URL is `https://gotify.example.org/auth/oidc/callback`.
55+
- If Gotify is served on a sub-path (e.g. behind a reverse proxy at `/gotify/`), the sub-path must be included: `https://example.org/gotify/auth/oidc/callback`.
56+
- For the **Android app** to support OIDC login, you must add `gotify://oidc/callback` as an additional redirect URL in your identity provider's client configuration.
57+
58+
This URL must match **exactly** between the Gotify config and your identity provider's client configuration.
59+
60+
## Authelia
61+
62+
[Authelia](https://www.authelia.com/) is a self-hosted authentication and authorization server.
63+
64+
::: details Authelia configuration (configuration.yml)
65+
66+
```yml
67+
identity_providers:
68+
oidc:
69+
clients:
70+
- client_id: 'gotify'
71+
client_name: 'gotify'
72+
client_secret: '$pbkdf2-sha512$310000$...' # generate with: authelia crypto hash generate pbkdf2
73+
public: false
74+
authorization_policy: 'two_factor'
75+
require_pkce: true
76+
pkce_challenge_method: 'S256'
77+
consent_mode: implicit
78+
redirect_uris:
79+
- 'https://gotify.example.org/auth/oidc/callback' # See redirect url docs
80+
- 'gotify://oidc/callback' # Required for Android app OIDC login
81+
scopes:
82+
- 'openid'
83+
- 'profile'
84+
- 'email'
85+
response_types:
86+
- 'code'
87+
grant_types:
88+
- 'authorization_code'
89+
access_token_signed_response_alg: 'none'
90+
userinfo_signed_response_alg: 'none'
91+
token_endpoint_auth_method: 'client_secret_basic'
92+
```
93+
94+
:::
95+
96+
## Dex
97+
98+
[Dex](https://dexidp.io/) is a federated OpenID Connect provider.
99+
100+
::: details Dex configuration
101+
102+
```yml
103+
staticClients:
104+
- id: gotify
105+
redirectURIs:
106+
- 'https://gotify.example.org/auth/oidc/callback' # See redirect url docs
107+
- 'gotify://oidc/callback' # Required for Android app OIDC login
108+
name: 'Gotify'
109+
secret: secret
110+
```
111+
112+
:::

0 commit comments

Comments
 (0)