Setting up with various providers

[!NOTE] This page contains instructions on how to set up <a class="reference-link" href="../Signing%20in%20with%20OpenID%20Connect.md">Signing in with OpenID Connect</a> with various providers such as Authelia, GitLab,. Google. Note that while the configuration reference is correct and up to date, the steps to create the OAuth application might differ slightly as providers change their UI.

Authelia

1. Generate a client secret:

   Copy

   authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
   
   

   Random Password goes to Trilium, Digest (the $pbkdf2-sha512$… string) goes to Authelia.

2. Add a client under identity_providers.oidc.clients in Authelia's configuration.yml, replacing <server> with the URL of your Trilium instance:

   yamlCopy

   identity_providers:
     oidc:
       clients:
         - client_id: 'trilium'
           client_name: 'Trilium'
           client_secret: '<Digest>'
           public: false
           authorization_policy: 'two_factor'
           redirect_uris:
             - 'https://<server>/callback'
           scopes:
             - 'openid'
             - 'profile'
             - 'email'
   

   Unlike GitLab, client_id is a name you choose rather than one the provider generates.

3. Restart Authelia.

Adjust config.ini, using the Random Password from step 1:

[MultiFactorAuthentication]
oauthBaseUrl=https://<server>
oauthClientId=<ClientId>
oauthClientSecret=<RandomPassword>
oauthIssuerBaseUrl=https://<server>
oauthIssuerName=Authelia

[!IMPORTANT] Do not set oauthClientAuthMethod for Authelia. It defaults confidential clients to client_secret_basic and rejects any other method with invalid_client, which is the default Trilium already uses. This is the opposite of the GitLab case below.

GitLab (self-hosted or cloud)

1. Go to user settings on gitlab.com or your own self-hosted instance.
2. Press Add new application.
3. Give it a name (e.g. Trilium).
4. Set Redirect URI to https://<server>/callback
5. Make sure Confidential is checked and Device authorization grant is unchecked.
6. Under scopes, check openid, profile and email (they should be near the end).
7. Save the application and copy the Application ID and Secret.

Adjust config.ini as follows, replacing <ApplicationId> and <Secret> with the values from the last step as well as the <server> with a URL to your Trilium instance.

[MultiFactorAuthentication]
oauthBaseUrl=https://<server>
oauthClientId=<ApplicationId>
oauthClientSecret=<Secret>
oauthIssuerBaseUrl=https://gitlab.com
oauthIssuerName=GitLab
oauthClientAuthMethod=client_secret_post

[!IMPORTANT] If you are using a self-hosted instance of GitLab, make sure to also update oauthIssuerBaseUrl, and keep the oauthClientAuthMethod line above.

GitLab's token endpoint does not decode credentials sent via HTTP Basic, so without oauthClientAuthMethod, sign-in fails with a server responded with a challenge in the WWW-Authenticate HTTP Header error. Trilium applies this automatically for gitlab.com, but a self-hosted issuer URL cannot be detected.

GitHub

GitHub cannot be used as an identity provider because it is plain OAuth 2.0 and not OpenID Connect, so it will fail with OAUTH_RESPONSE_IS_NOT_CONFORM.

Google

1. Go to Google Cloud's Clients dashboard and select Create client.
2. For Application type, select Web application.
3. In Authorized redirect URIs, set  https://<server>/callback.
4. Press Create and copy Client ID and Client secret.

Adjust config.ini as follows, replacing <ClientID> and <ClientSecret> with the values from the last step as well as the <server> with a URL to your Trilium instance.

[MultiFactorAuthentication]
oauthBaseUrl=https://<server>
oauthClientId=<ClientID>
oauthClientSecret=<ClientSecret>