mirror of
https://github.com/goauthentik/authentik
synced 2026-04-27 09:57:31 +02:00
6ed5cb5249
* website/integrations: rename "Create with Provider" to "New Application" The application list page now uses a split-button labeled "New Application" instead of the old "Create with Provider" dropdown. Update all 113 integration guides to match. * website/docs: update flow, stage, and policy button labels - "Create" → "New Flow", "New Stage", "New Policy" for trigger buttons - "Finish" → "Create Flow", "Create Stage", "Create Policy" for submit - "Create and bind stage" → "New Stage" / "Bind Existing Stage" - "Create" (binding submit) → "Create Stage Binding" * website/docs: update provider button labels - "Create" → "New Provider" for trigger buttons - "Create with Provider" → "New Application" in RAC docs - "Create" → "New Property Mapping", "New RAC Endpoint", "New Prompt" for related entity creation * website/docs: update directory button labels - "Create" → "New Source" for federation/social login pages - "Create" → "New Role", submit → "Create Role" - "Create" → "New Invitation" - Policy binding submit → "Create Policy Binding" * website/docs: update endpoint device and system management button labels - "Create" → "New Endpoint Connector", "New Enrollment Token", "New Device Access Group", "New Flow" - Submit → "Create Device Access Group" - "Create" → "New Notification Rule", "New Notification Transport" - Binding submit → "Create Policy Binding" * Reorganize policy documentation * website/docs: address policy docs review feedback * post-rebase * website/docs: Reorganize policy documentation -- Revisions (#21601) * apply suggestions * Fix escaped. * Fix whitespace. * Update button label. * Fix phrasing. * Fix phrasing. * Clean up stragglers. * Format. --------- Co-authored-by: Dominic R <dominic@sdko.org>
61 lines
3.6 KiB
Plaintext
61 lines
3.6 KiB
Plaintext
---
|
|
title: OAuth Source
|
|
---
|
|
|
|
This source allows users to enroll themselves with an external OAuth-based Identity Provider. The generic provider expects the endpoint to return OpenID-Connect compatible information. Vendor-specific implementations have their own OAuth Source.
|
|
|
|
- Policies: Allow/Forbid users from linking their accounts with this provider.
|
|
- Icon: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.md).
|
|
- Request Token URL: This field is used for OAuth v1 implementations and will be provided by the provider.
|
|
- Authorization URL: This value will be provided by the provider.
|
|
- Access Token URL: This value will be provided by the provider.
|
|
- Profile URL: This URL is called by authentik to retrieve user information upon successful authentication.
|
|
- Consumer key/Consumer secret: These values will be provided by the provider.
|
|
- Scopes: Configure additional scopes to send to the provider.
|
|
|
|
Starting with authentik 2022.10, the default scopes can be replaced by prefixing the value for scopes with `*`.
|
|
|
|
## OpenID Connect
|
|
|
|
### Well-known
|
|
|
|
Instead of configuring the URLs for a source manually, if the application you're configuring implements the [OpenID Connect Discovery Spec](https://openid.net/specs/openid-connect-discovery-1_0.html), you can configure the source with a single URL. The URL should always end with `.well-known/openid-configuration`. Many applications don't explicitly mention this URL, but for most of them it will be `https://application.company/.well-known/openid-configuration`.
|
|
|
|
This URL is fetched upon saving the source, and all the URLs will be replaced by the ones from the Discovery document. No automatic re-fetching is done.
|
|
|
|
### JWKS
|
|
|
|
To simplify machine-to-machine authentication, you can create an OAuth Source as a "trusted" source of JWTs. Create a source and configure either the Well-known URL or the OIDC JWKS URL, or you can manually enter the JWKS data if you so desire.
|
|
|
|
Afterwards, this source can be selected in one or multiple OAuth2 providers, and any JWT issued by any of the configured sources' JWKS will be able to authenticate. To learn more about this, see [JWT-authentication](../../../../add-secure-apps/providers/oauth2/machine_to_machine#jwt-authentication).
|
|
|
|
### `login_hint` parameter
|
|
|
|
If the OAuth authentication was started from within an authentik flow and the user has already identified themselves, authentik will set the `login_hint` parameter to the email address of the user. If the Identification stage has the **Pretend user exists** option enabled and a user could not be found, the `login_hint` value will be set to the identifier that the user entered.
|
|
|
|
## OAuth source property mappings
|
|
|
|
See the [overview](../../property-mappings/index.md) for information on how property mappings work.
|
|
|
|
### Expression data
|
|
|
|
The following variables are available to OAuth source property mappings:
|
|
|
|
- `info`: A Python dictionary containing OAuth claims. For example (values might differ depending on the source):
|
|
```python
|
|
{
|
|
"iss": "https://source.company",
|
|
"sub": "f153e7da687eec8c8789c72b6cc6bb5197df7b48b263b3151f36908e1bc10691",
|
|
"aud": "01e4DmQiG1d3kaewD3Mkz7E7kXknk9j43eZMkNaE",
|
|
"aud": "a7809c1b1c4aaa50adfb68660a6273dd9c8d15e4",
|
|
"email": "user@authentik.company",
|
|
"email_verified": True,
|
|
"name": "User",
|
|
"given_name": "User",
|
|
"preferred_username": "user",
|
|
"nickname": "user",
|
|
}
|
|
```
|
|
- `client`: An OAuth client object to make requests to the Source with authentication built-in.
|
|
- `token`: A Python dictionary containing OAuth tokens.
|