Documentation

• Welcome
• User guide
• Admin guide
• FileRun homepage
• Changelog
• Contact us

Install

• Requirements
• Install guides
• Docker installation
• Manual installation
• PHP configuration
  • PHP compatibility
  • PHP upgrade
  • ionCube loader
• Troubleshooting
• Reverse proxies
• Securing FileRun
• Server optimization

Configure

• Setting the time zone
• System settings
• Sign-in and passwords
• User sign-up
• Storage quotas
• Data retention
• File settings
• Enabling thumbnails and preview
  • Troubleshooting thumbnails
• E-mail notification system
• File preview options
  • File plugins
• File indexing
• Authentication integration
  • OpenID Connect
  • Authentik
  • OAuth2
  • LDAP
  • Active Directory
  • SimpleSAMLphp
  • Microsoft Entra ID
  • Google
  • Dropbox
  • Box.com
• Two-factor authentication
• Advanced configuration

Customize

• Branding
• Theme colors
• Favicons
• Custom CSS
• Translating FileRun
• Custom event scripts

Using FileRun

• File searching
• Metadata
• Organizing files
• Collections
• The media libraries
• The trash
• File-based activity logs
• Screenshot sharing
• Guest accounts
• Your account settings
  • App passwords

Access methods

• Desktop sync
• Mobile apps
• WebDAV

Collaborative editing

• Overview
• Collabora Online
• ONLYOFFICE Docs
• Microsoft 365
• Zoho Editor
• Google Docs Editor

The API

• Introduction
• File paths
• API Methods
• Migrating from an older version
• Changes in 2026.3

Maintenance

• Resetting the superuser password
• Updating FileRun
• Backing up the installation
• Changing database connection information
• Deleting old user files
• Migrating to another server
• Command line tools

• Authentik Authentication
  • Step 1: Create the provider and the application in Authentik
  • Step 2: Configure the FileRun plugin
    • Signing out
  • Step 3: Testing
  • The deprecated OAuth2 plugin

Authentik Authentication🔗

Authentik is a self-hosted identity provider. FileRun ships two plugins for it:

• Authentik OpenID Connect — the current plugin. Use this one.
• Authentik OAuth2 — deprecated. Installations already using it keep working untouched, but moving to the OpenID Connect plugin is recommended.

The OpenID Connect plugin signs users out in both directions, which the OAuth2 one does not.

Enable and configure the plugin from the control panel, under Users → Authentication.

Step 1: Create the provider and the application in Authentik🔗

In Authentik, create an OAuth2/OpenID provider and the application that uses it.

The provider asks for a redirect URI. FileRun shows the exact value in the Redirect URL field of the plugin's settings; copy it from there with the button next to the field.

From the provider's overview page in Authentik, note down:

• the Client ID,
• the Client Secret,
• the OpenID Configuration Issuer, which ends with /application/o/{application-slug}/.

Step 2: Configure the FileRun plugin🔗

Select Authentik OpenID Connect from the Enabled plugin list and fill in:

• Issuer URL — the OpenID Configuration Issuer value from Authentik.
• Client ID and Client Secret — from the same page.

There is nothing else to set. Authentik serves the standard OpenID Connect claims, so the scopes and the field mapping are built into the plugin.

If you are moving from the deprecated Authentik OAuth2 plugin, the client ID and secret you already had are filled in for you. You only have to add the issuer URL.

Signing out🔗

Signing out of FileRun ends the Authentik session as well, with no configuration needed.

To have Authentik end the FileRun session when the Authentik session ends, copy the Back-channel logout URL shown in the plugin's settings and configure it in Authentik as the provider's backchannel logout URL. See OpenID Connect.

Step 3: Testing🔗

Use the Save and test authentication button before enabling the plugin, and open the test link in a private browser window.

Keep Allow local user accounts to log in enabled until you are sure the setup works. If you are locked out, follow Disabling the authentication integration.

The deprecated OAuth2 plugin🔗

Authentik OAuth2 takes an Authentik URL, a Client ID and a Client Secret, the last two coming from the Applications → Providers section of Authentik. It does not sign users out at Authentik. Use it only for an installation that already depends on it.