Integrate with OpenID Connect providers for single sign-on.

Basic Setup

YAML 
1
2
3
4
5
6
7
8
9

auth:
  methods:
    oidc:
      enabled: true
      clientId: "filebrowser-client"
      clientSecret: "xxx"  # Use environment variable
      issuerUrl: "https://sso.example.com/application/o/filebrowser/"
      scopes: "email openid profile groups"
      userIdentifier: "preferred_username"

Configuration Options

OptionDescription
enabledEnable OIDC authentication
clientIdOIDC client ID
clientSecretOIDC client secret (use env var)
issuerUrlOIDC provider URL
scopesRequested scopes
userIdentifierUser field (preferred_username, email, username, phone)
adminGroupOIDC group name for admin rights
userGroupsList of allowed groups (empty = allow all) - requires v1.3.x+
groupsClaimJSON field for groups (default: groups)
disableVerifyTLSDisable TLS verification (testing only!)
logoutRedirectUrlProvider logout URL

Issuer URL Examples

Authentik:

TEXT 
1

https://domain.com/application/o/filebrowser/

Pocket ID/Authelia:

TEXT 
1

https://domain.com

Callback URL

Append /api/auth/oidc/callback to the end of your base URL to get FileBrowser’s OIDC callback URL.

Configure in your OIDC provider:

TEXT 
1

https://your-domain.com/api/auth/oidc/callback

If you a custom baseURL in your config.yaml:

TEXT 
1

https://your-domain.com/custom-base/api/auth/oidc/callback

Auto-Redirect

When OIDC is the only auth method, users are automatically redirected to the OIDC provider.

YAML 
1
2
3
4
5
6

auth:
  methods:
    password:
      enabled: false
    oidc:
      enabled: true

Provider Examples

Authentik

YAML 
1
2
3
4
5
6
7
8

auth:
  methods:
    oidc:
      enabled: true
      clientId: "xxx"
      clientSecret: "xxx"
      issuerUrl: "https://auth.example.com/application/o/filebrowser/"
      adminGroup: "authentik Admins"

Authelia

YAML 
1
2
3
4
5
6
7

auth:
  methods:
    oidc:
      enabled: true
      clientId: "xxx"
      clientSecret: "xxx"
      issuerUrl: "https://auth.example.com"

Group-Based Access Control

Admin Group

Grant admin privileges to users in a specific OIDC group:

YAML 
1
2
3
4
5
6
7
8

auth:
  methods:
    oidc:
      enabled: true
      clientId: "xxx"
      clientSecret: "xxx"
      issuerUrl: "https://auth.example.com"
      adminGroup: "FileBrowser Admins"

Restrict login to Specific Groups

Only allow users in specific OIDC groups to access FileBrowser:

YAML 
1
2
3
4
5
6
7
8

auth:
  methods:
    oidc:
      enabled: true
      clientId: "xxx"
      clientSecret: "xxx"
      issuerUrl: "https://auth.example.com"
      userGroups: ["FileBrowser Users", "guests"]

Users not in these groups will be denied access even with valid OIDC authentication.

Next Steps