OIDC Authentication

Integrate with OpenID Connect providers for single sign-on.

Basic Setup link

1
2
3
4
5
6
7
8
9

auth:
  methods:
    oidc:
      enabled: true
      clientId: "filebrowser-client"
      clientSecret: "xxx"  # Use environment variable
      issuerUrl: "https://sso.example.com/application/o/filebrowser/"
      scopes: "openid email profile"
      userIdentifier: "preferred_username"

If you need group claims, add them to scopes (for example groups) per your provider.

Configuration Options link

Defaults (when omitted): groupsClaim is groups, userIdentifier is preferred_username, and scopes defaults to openid email profile.

Issuer URL Examples link

Authentik:

1

https://domain.com/application/o/filebrowser/

Pocket ID/Authelia:

1

https://domain.com

Callback URL link

Append /api/auth/oidc/callback to the end of your base URL to get FileBrowser’s OIDC callback URL.

Configure in your OIDC provider:

1

https://your-domain.com/api/auth/oidc/callback

If you use a custom baseURL in your config.yaml:

1

https://your-domain.com/custom-base/api/auth/oidc/callback

Reverse proxy link

When FileBrowser sits behind HTTPS nginx, Traefik, or Caddy, the incoming request often arrives as http:// with the proxy’s internal host. Configure forwarded headers so the request-derived callback uses the browser-facing scheme and host.

v2.0.0+ — single boolean (replaces the v1.4.x–v1.5.x trustedHeaders list):

1
2
3

http:
  baseURL: "/files"
  trustProxyHeaders: true

v1.4.x–v1.5.x — list the forwarding headers your proxy sets:

1
2
3
4
5
6
7

http:
  baseURL: "/files"
  trustedHeaders:
    - X-Forwarded-Proto
    - X-Forwarded-Host
    - X-Forwarded-For
    - X-Real-IP

Your proxy must send at least X-Forwarded-Proto: https and X-Forwarded-Host matching the browser URL. Without header trust enabled, the callback may register as http:// or the wrong host and your OIDC provider will reject login.

On v2.0.0+, FileBrowser logs a warning when OIDC is enabled but trustProxyHeaders is false.

See Running behind a reverse proxy and HTTP reverse-proxy headers.

Auto-Redirect link

When OIDC is the only auth method, users are automatically redirected to the OIDC provider.

1
2
3
4
5
6

auth:
  methods:
    password:
      enabled: false
    oidc:
      enabled: true

Provider Examples link

1
2
3
4
5
6
7
8

auth:
  methods:
    oidc:
      enabled: true
      clientId: "xxx"
      clientSecret: "xxx"
      issuerUrl: "https://auth.example.com/application/o/filebrowser/"
      adminGroup: "authentik Admins"

1
2
3
4
5
6
7

auth:
  methods:
    oidc:
      enabled: true
      clientId: "xxx"
      clientSecret: "xxx"
      issuerUrl: "https://auth.example.com"

Group-Based Access Control link

On successful OIDC login, groups from groupsClaim are synced into FileBrowser’s access-control GroupMap (write-through to the database) so group allow/deny rules apply. For path-level group isolation, use denyByDefault on the source.

Admin Group link

1
2
3
4
5
6
7
8

auth:
  methods:
    oidc:
      enabled: true
      clientId: "xxx"
      clientSecret: "xxx"
      issuerUrl: "https://auth.example.com"
      adminGroup: "FileBrowser Admins"

Restrict login to Specific Groups link

1
2
3
4
5
6
7
8

auth:
  methods:
    oidc:
      enabled: true
      clientId: "xxx"
      clientSecret: "xxx"
      issuerUrl: "https://auth.example.com"
      userGroups: ["FileBrowser Users", "guests"]

Next Steps link

• Password authentication
• Proxy authentication