An introduction into integrating the Authelia OpenID Connect Provider with an OpenID Connect relying party.
Authelia can act as an OpenID Connect 1.0 Provider as part of an open beta. This section details implementation specifics that can be used for integrating Authelia with an OpenID Connect 1.0 Relying Party, as well as specific documentation for some OpenID Connect 1.0 Relying Party implementations.
This is the default scope for OpenID Connect 1.0. This field is forced on every client by the configuration validation that Authelia does.
Important Note: The subject identifiers or
sub Claim has been changed to a RFC4122 UUID V4 to identify the
individual user as per the Subject Identifier Types section of the OpenID Connect 1.0 specification. Please use the
preferred_username Claim instead.
|The issuer name, determined by URL
|A RFC4122 UUID V4 representing the JWT Identifier
|The time when the token was requested
|The time when the token was issued
|The time the user authenticated with Authelia
|A RFC4122 UUID V4 linked to the user who logged in
|Granted scopes (space delimited)
|An RFC8176 list of authentication method reference values
|The authorized party
|The client id
This scope is a special scope designed to allow applications to obtain a Refresh Token which allows extended access to an application on behalf of a user. A Refresh Token is a special Access Token that allows refreshing previously issued token credentials, effectively it allows the relying party to obtain new tokens periodically.
Generally unless an application supports this and actively requests this scope they should not be granted this scope via the client configuration.
|List of user’s groups discovered via authentication
|The first email address in the list of emails
|If the email is verified, assumed true for the time being
|All email addresses that are not in the email JWT field
|The username the user used to login with
|The users display name
Authentication Method References
The values this Claim has are not strictly defined by the OpenID Connect 1.0 specification. As such, some backends may expect a specification other than RFC8176 for this purpose. If you have such an application and wish for us to support it then you’re encouraged to create a feature request.
Below is a list of the potential values we place in the Claim and their meaning:
|User used multiple factors to login (see factor column)
|User used multiple channels to login (see channel column)
|User confirmed they were present when using their hardware key
|User confirmed they are the owner of the hardware key with a pin
|User used a username and password to login
|User used TOTP to login
|User used a hardware key to login
|User used Duo to login
User Information Signing Algorithm
The following section documents the endpoints we implement and their respective paths. This information can traditionally be discovered by relying parties that utilize OpenID Connect Discovery, however this information may be useful for clients which do not implement this.
The endpoints can be discovered easily by visiting the Discovery and Metadata endpoints. It is recommended regardless of your version of Authelia that you utilize this version as it will always produce the correct endpoint URLs. The paths for the Discovery/Metadata endpoints are part of IANA’s well known registration but are also documented in a table below.
These tables document the endpoints we currently support and their paths in the most recent version of Authelia. The paths are appended to the end of the primary URL used to access Authelia. The tables use the url https://auth.example.com as an example of the Authelia root URL which is also the OpenID Connect issuer.
Well Known Discovery Endpoints
These endpoints can be utilized to discover other endpoints and metadata about the Authelia OP.
|OpenID Connect Discovery
|OAuth 2.0 Authorization Server Metadata
These endpoints implement OpenID Connect elements.
|JSON Web Key Sets