The OpenID Connect plugin connects FileRun to any identity provider that supports the OpenID
Connect standard — Authentik, Keycloak, Authelia, Microsoft Entra ID, Google and others.
Compared with the OAuth2 plugin, it needs far less configuration: FileRun reads the provider's endpoints from its discovery document instead of having them typed in one by one. It also validates the ID token's signature against the provider's keys, uses PKCE, and can sign users out in both directions.
For Authentik there is a dedicated plugin, which needs even less: see Authentik.
Enable and configure the plugin from the control panel, under Users → Authentication.
Select OpenID Connect from the Enabled plugin list.
Create an application (some providers call it a client) in your identity provider, of the type that uses the authorization code flow.
The provider will ask for a redirect URL. FileRun shows the exact value in the Redirect URL
field of the plugin's settings; copy it from there with the button next to the field.
The redirect URL is an
https://address. Identity providers refuse plain HTTP, so your FileRun installation needs a valid SSL certificate.
The provider then gives you a client ID and a client secret.
The provider's issuer URL. FileRun reads the configuration from
{issuer URL}/.well-known/openid-configuration, which is where it finds the authorization,
token, user info and end-session endpoints.
If your provider documents a .well-known/openid-configuration address, the issuer URL is that
address without the /.well-known/openid-configuration part.
The values your provider gave you in step 1.
openid email profile by default, which is what most providers need. Separate several values
with a space.
FileRun reads the user's details from the provider's user info response and creates the FileRun account from them. Each field takes a JSONPath selector, and the defaults are the standard OpenID Connect claims:
| Field | Default | Claim |
|---|---|---|
Username mapping |
$.preferred_username |
preferred_username |
First name mapping |
$.given_name |
given_name |
Last name mapping |
$.family_name |
family_name |
E-mail mapping |
$.email |
email |
Phone number mapping |
$.phone_number |
phone_number |
Leave them as they are unless your provider names its claims differently. The OAuth2 page explains how a JSONPath selector picks a value out of the response.
Signing out of FileRun can also end the session at the provider, and the other way round.
FileRun signs the user out at the provider. This happens by itself: when the user signs out of FileRun, the browser is sent to the provider's end-session endpoint, which the discovery document names.
The provider signs the user out of FileRun. This is optional and is configured at the
provider's end. The plugin's settings show a Back-channel logout URL; give that address to your
provider as the back-channel logout URL of the application. The provider then posts a signed
logout token to it when the session ends, and FileRun closes the matching sessions. The event is
written to the activity log.
Use the Save and test authentication button before enabling the plugin. Open the test link in a
private browser window, so it does not disturb your current FileRun session.
Keep
Allow local user accounts to log inenabled until you are sure the setup works, so that the FileRun superuser can still sign in with its own password. If you are locked out, follow Disabling the authentication integration.