authelia/index.md at master

3.6 KiB

Raw Permalink Blame History

title

description

summary

date

draft

images

weight

toc

support

seo

HumHub

Integrating HumHub with the Authelia OpenID Connect 1.0 Provider.

2024-03-30T07:14:05+11:00

false

620

true

level	versions	integration
community	true	true

title	description	canonical	noindex
			false

Tested Versions

Authelia
- v4.38.6
HumHub
- 1.15.4

Assumptions

This example makes the following assumptions:

Application Root URL: https://humhub.{{< sitevar name="domain" nojs="example.com" >}}/
Authelia Root URL: https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}/
Client ID: humhub
Client Secret: insecure_secret

Some of the values presented in this guide can automatically be replaced with documentation variables.

Configuration

Authelia

The following YAML configuration is an example Authelia client configuration for use with HumHub which will operate with the application example:

identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
      - client_id: 'humhub'
        client_name: 'HumHub'
        client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
        public: false
        authorization_policy: 'two_factor'
        redirect_uris:
          - 'https://humhub.{{< sitevar name="domain" nojs="example.com" >}}/user/auth/external?authclient=oidc'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        grant_types:
          - 'authorization_code'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'

Application

To configure HumHub to utilize Authelia as an OpenID Connect 1.0 Provider:

Build your own HumHub with the OIDC Connector
Configure a new oidc provider in config/common.php:

return [
    'components' => [
        'urlManager' => [
            'enablePrettyUrl' => true,
        ],
        'authClientCollection' => [
          'clients' => [
            'oidc' => [
              'class' => 'worteks\humhub\authclient\OIDC',
              'domain' => 'https://{{< sitevar name="subdomain-authelia" nojs="auth" >}}.{{< sitevar name="domain" nojs="example.com" >}}',
              'clientId' => 'humhub',
              'clientSecret' => 'insecure_secret',
              'defaultTitle' => 'login with SSO',
              'cssIcon' => 'fa fa-sign-in',
              'authUrl' => '/api/oidc/authorization',
              'tokenUrl' => '/api/oidc/token',
              'apiBaseUrl' => '/api/oidc',
              'userInfoUrl' => 'userinfo',
              'scope' => 'openid profile email'
            ],
         ],
       ],
    ],
];

3.6 KiB Raw Permalink Blame History