Integrate with OpenID Connect providers for single sign-on.

Basic Setup 

auth:
  methods:
    oidc:
      enabled: true
      clientId: "filebrowser-client"
      clientSecret: "xxx"  # Use environment variable
      issuerUrl: "https://sso.example.com/application/o/filebrowser/"
      scopes: "email openid profile groups"
      userIdentifier: "preferred_username"
      createUser: true

Configuration Options

OptionDescription
enabledEnable OIDC authentication
clientIdOIDC client ID
clientSecretOIDC client secret (use env var)
issuerUrlOIDC provider URL
scopesRequested scopes
userIdentifierUser field (preferred_username, email, username, phone)
createUserAuto-create users on first login
adminGroupOIDC group name for admin rights
groupsClaimJSON field for groups (default: groups)
disableVerifyTLSDisable TLS verification (testing only!)
logoutRedirectUrlProvider logout URL

Issuer URL Examples

Authentik/Authelia:

https://domain.com/application/o/filebrowser/

Pocket ID:

https://domain.com/

Callback URL

Configure in your OIDC provider:

https://your-domain.com/api/auth/oidc/callback

With custom baseURL:

https://your-domain.com/custom-base/api/auth/oidc/callback

Auto-Redirect

When OIDC is the only auth method, users are automatically redirected:

auth:
  methods:
    password:
      enabled: false
    oidc:
      enabled: true

Provider Examples

Authentik 

auth:
  methods:
    oidc:
      enabled: true
      clientId: "xxx"
      clientSecret: "xxx"
      issuerUrl: "https://auth.example.com/application/o/filebrowser/"
      adminGroup: "authentik Admins"

Authelia 

auth:
  methods:
    oidc:
      enabled: true
      clientId: "xxx"
      clientSecret: "xxx"
      issuerUrl: "https://auth.example.com"

Next Steps