OIDC Configuration Guide

[arcoast]

I have both Authelia and Pocket ID installed and have tested both with Typetype and confirmed both the below configurations as working.

Thought I'd post them here for reference just in case it's useful for anyone else.

OIDC with Authelia

Authelia Config

Generate a random client_id/OIDC_CLIENT_ID with

openssl rand -hex 36

Generate your own client_secret with

docker run authelia/authelia:latest \
    authelia crypto hash generate pbkdf2 \
        --variant sha512 \
        --random \
        --random.length 72 \
        --random.charset \
        rfc3986

Generates the output

Random Password: j41gha7hupDXqKA.ZG1n0qLo_1gFaa4xMNHiRsc_ucKErIJ3fs4xMao-jKxwDvJZwroUgoP2
Digest: $pbkdf2-sha512$310000$AZbykWD1yNdqEZMLLvFWXQ$v8sxTC2eiDrzXs5v3fp5iL.J5D05zgugo6fYVMf23qXh8t.D793l9WJpWKHC9eAdD1HMJvaif0SC5qykwfTzHw

The Random Password should be added to your Typetype .env file as below and the Digest should be used as the client_secret in your config in Authelia.

identity_providers:
  oidc:
    claims_policies:
      legacy:
        id_token: ['email', 'email_verified', 'groups', 'preferred_username', 'name']

    authorization_policies:
      typetype:
        default_policy: deny
        rules:
          - policy: two_factor
            subject: group:typetype

    clients:
      - client_id: 9ef93e4d37300cc2ba82a4121e4641513b8468065a4dd13aa05af821c420356860513558 # Replace with your own value
        client_name: Typetype
        client_secret: $pbkdf2-sha512$310000$AZbykWD1yNdqEZMLLvFWXQ$v8sxTC2eiDrzXs5v3fp5iL.J5D05zgugo6fYVMf23qXh8t.D793l9WJpWKHC9eAdD1HMJvaif0SC5qykwfTzHw # Replace with your own value
        public: false
        authorization_policy: typetype
        consent_mode: implicit
        claims_policy: legacy
        scopes: 
          - openid
          - profile
          - email
        redirect_uris:
          - https://typetype.DOMAIN.COM/auth/oidc/callback
        token_endpoint_auth_method: client_secret_post

Remember to restart your Authelia container after editing your configuration.

Typetype Config

# OIDC - Authelia
OIDC_PROVIDER_NAME="Authelia"
OIDC_ISSUER=https://authelia.DOMAIN.COM
OIDC_CLIENT_ID=9ef93e4d37300cc2ba82a4121e4641513b8468065a4dd13aa05af821c420356860513558 # Replace with your own value
OIDC_CLIENT_SECRET=j41gha7hupDXqKA.ZG1n0qLo_1gFaa4xMNHiRsc_ucKErIJ3fs4xMao-jKxwDvJZwroUgoP2 # Replace with your own value
# Below not required - but included for reference and commented out
# OIDC_SCOPES="openid email profile"
# OIDC_DISCOVERY_URL=https://authelia.DOMAIN.COM/.well-known/openid-configuration

and add the following to your typetype-server environment:

OIDC_PROVIDER_NAME: ${OIDC_PROVIDER_NAME}
OIDC_ISSUER: ${OIDC_ISSUER}
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
# Below not required - but included for reference and commented out
# OIDC_SCOPES: ${OIDC_SCOPES}
# OIDC_DISCOVERY_URL: ${OIDC_DISCOVERY_URL}

OIDC with Pocket ID

Pocket ID Config

Parameter	Value
Name	Typetype
Callback URLs	https://typetype.DOMAIN.COM/auth/oidc/callback
Client Launch URL	https://typetype.DOMAIN.COM/
Logout Callback URLs	Leave blank
Public Client	Leave toggled off
Requires Re-authentication	Leave toggled off
PKCE	Leave toggled off

Download the icon from here and upload it to Pocket ID.

Then copy the generated Client ID and Client Secret values from Pocket ID into the Typetype .env

# OIDC (Pocket ID)
OIDC_PROVIDER_NAME="Pocket ID"
OIDC_ISSUER=https://pocket-id.DOMAIN.COM
OIDC_CLIENT_ID=4dcd215a-3c61-40f4-876d-d6f6f5028083     # Replace with your own value
OIDC_CLIENT_SECRET=Ogu9igVaapIUlJkNK0xtFj2l9RVDEyGu  # Replace with your own value
# Below not required - but included for reference and commented out
# OIDC_SCOPES="openid email profile"
# OIDC_DISCOVERY_URL=https://pocket-id.DOMAIN.COM/.well-known/openid-configuration

and add the following to your typetype-server environment:

OIDC_PROVIDER_NAME: ${OIDC_PROVIDER_NAME}
OIDC_ISSUER: ${OIDC_ISSUER}
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
# Below not required - but included for reference and commented out
# OIDC_SCOPES: ${OIDC_SCOPES}
# OIDC_DISCOVERY_URL: ${OIDC_DISCOVERY_URL}

Perhaps others can add their own configs for any other OIDC providers.