Configure OAuth2 OpenID Connect (OIDC)#

Colectica Repository can use OpenID Connect for authentication of both web portal users and REST API clients. The inclusion of the email claim is required in the OIDC profile to enable account creation. Follow these instructions to enable OpenID Connect support.

In PortalDir\appsettings.json, find the OpenIDConnect section.

"OpenIDConnect":
{
   "Enabled": "false",
   "Authority": "",
   "ClientId": "",
   "ClientSecret": "",
   "Audience": "",
   "NameClaimType": "",
   "EmailClaimType": "",
   "GetClaimsFromUserInfoEndpoint": "true",
   "ValidateIssuer": "true",
   "UseIntrospection": "false"
}

Set the Enabled property to true.
Set the Authority property to the URL for your OIDC server, such as https://login.example.org/realms/master.
Set the ClientId and ClientSecret for the client you have configured on your OIDC authority. The redirect URI registered with the authority must be your repository URL plus /signin-oidc, and the logout URI your repository URL plus /signout-callback-oidc.
For JWT bearer tokens used with the REST API and MCP server, set the Audience which should be used, or leave blank.
Optionally set NameClaimType and EmailClaimType to the claim types that carry the user’s name and email address, if your provider does not use the standard claims.
Set ValidateIssuer to false only if tokens are issued by a different issuer than the authority.
Set UseIntrospection to true to validate bearer tokens by calling the authority’s token introspection endpoint instead of validating JWT signatures locally. This is required for providers that issue opaque access tokens.
Users are created in the portal automatically when they first log in. New users receive the role named in the DefaultNewUserRole setting. To assign roles, either manage the users in Users, or include a role claim in the tokens (Keycloak realm roles are also recognized) and set RepositorySettings:Features:SynchronizeExternalRoles to true so that the roles in the token replace the roles stored in the portal.