Configuring Generic OIDC Authentication

Use Generic OIDC to integrate LobeHub with any OpenID Connect compliant identity provider not explicitly listed in our supported providers.

In your identity provider's admin console:

1. Create a new OIDC/OAuth2 application
2. Set the application type to Web Application or Confidential Client
3. Enable required scopes: openid, profile, email
4. Note down Client ID and Client Secret

Configure Redirect URI

Add the callback URL to your OIDC provider:

<Callout type={'info'}> Callback URL format:

- Local development: `http://localhost:3210/api/auth/callback/generic-oidc`
- Production: `https://your-domain.com/api/auth/callback/generic-oidc`

Find Your Issuer URL

The issuer URL is typically found in your provider's OIDC discovery document:

https://your-provider/.well-known/openid-configuration

Look for the issuer field in the JSON response.

Configure Environment Variables

<Callout type={'tip'}> Go to 📘 Environment Variables for detailed information. </Callout> </Steps>

<Callout type={'info'}> After successful deployment, users will be able to authenticate with your OIDC provider and use LobeHub. </Callout>

Troubleshooting

Common Issues

1. Invalid redirect URI: Ensure the callback URL exactly matches what you configured in your provider
2. Missing scopes: Make sure openid, profile, and email scopes are enabled
3. Invalid issuer: The issuer URL must match exactly what's in the OIDC discovery document

Testing OIDC Configuration

Verify your OIDC configuration by accessing:

https://your-provider/.well-known/openid-configuration

This should return a JSON document with all required endpoints.