authelia/docs/content/integration/openid-connect/gitea/index.md

title	description	summary	date	draft	images	weight	toc	support	seo
Gitea	Integrating Gitea with the Authelia OpenID Connect 1.0 Provider.		2022-07-01T13:07:02+10:00	false		620	true	level versions integration community true true	title description canonical noindex false

Tested Versions

• Authelia
  • v4.38.0
• Gitea
  • 1.17.0

{{% oidc-common %}}

Assumptions

This example makes the following assumptions:

• Application Root URL: https://gitea.{{< sitevar name="domain" nojs="example.com" >}}/
• Authelia Root URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/
• Client ID: gitea
• Client Secret: insecure_secret
• Authentication Name (Gitea): authelia:
  • This option determines the redirect URI in the format of https://gitea.{{< sitevar name="domain" nojs="example.com" >}}/user/oauth2/<Authentication Name>/callback. This means if you change this value you need to update the redirect URI.

Some of the values presented in this guide can automatically be replaced with documentation variables.

{{< sitevar-preferences >}}

Configuration

Authelia

The following YAML configuration is an example Authelia client configuration for use with Gitea which will operate with the application example:

identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
      - client_id: 'gitea'
        client_name: 'Gitea'
        client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
        public: false
        authorization_policy: 'two_factor'
        redirect_uris:
          - 'https://gitea.{{< sitevar name="domain" nojs="example.com" >}}/user/oauth2/authelia/callback'
        scopes:
          - 'openid'
          - 'email'
          - 'profile'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'

Application

To configure Gitea to utilize Authelia as an OpenID Connect 1.0 Provider:

1. Expand User Options
2. Visit Site Administration
3. Visit Authentication Sources
4. Visit Add Authentication Source
5. Configure:
   1. Authentication Name: authelia
   2. OAuth2 Provider: OpenID Connect
   3. Client ID (Key): gitea
   4. Client Secret: insecure_secret
   5. OpenID Connect Auto Discovery URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/.well-known/openid-configuration

{{< figure src="gitea.png" alt="Gitea" width="300" >}}

CLI

Important Note: Please refer to the Gitea CLI Guide regarding the correct usage of the CLI.

Alternatively, you can add the authentication source via command line:

gitea admin auth add-oauth --provider=openidConnect --name=authelia --key=gitea --secret=insecure_secret --auto-discover-url=https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/.well-known/openid-configuration --scopes='openid email profile'

You might have to run ./gitea migrate first in order to set up the database with the required structure.

To configure Gitea to perform automatic user creation for the {{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}} domain via OpenID Connect 1.0:

1. Edit the following values in the Gitea app.ini:

[openid]
ENABLE_OPENID_SIGNIN = false
ENABLE_OPENID_SIGNUP = true
WHITELISTED_URIS     = {{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}

[service]
DISABLE_REGISTRATION                          = false
ALLOW_ONLY_EXTERNAL_REGISTRATION              = true
SHOW_REGISTRATION_BUTTON                      = false

Take a look at the See Also section for the cheatsheets corresponding to the sections above for their descriptions.

See Also

• Gitea app.ini Config Cheat Sheet:
  • OpenID
  • Service