mirror of
https://github.com/danny-avila/LibreChat.git
synced 2025-09-21 21:50:49 +02:00
🛂 feat: Required OpenID Role (#2279)
* feat: add possibility to filter by roles for OpenID provider --------- Co-authored-by: Sirius <siriusfrk@gmail.com>
This commit is contained in:
Danny Avila
GitHub
parent
49753a35e5
commit
1bafe80e78
11 changed files with 599 additions and 441 deletions
|
|
@ -316,6 +316,9 @@ OPENID_ISSUER=
|
|||
OPENID_SESSION_SECRET=
|
||||
OPENID_SCOPE="openid profile email"
|
||||
OPENID_CALLBACK_URL=/oauth/openid/callback
|
||||
OPENID_REQUIRED_ROLE=
|
||||
OPENID_REQUIRED_ROLE_TOKEN_KIND=
|
||||
OPENID_REQUIRED_ROLE_PARAMETER_PATH=
|
||||
|
||||
OPENID_BUTTON_LABEL=
|
||||
OPENID_IMAGE_URL=
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ const fs = require('fs');
|
|||
const path = require('path');
|
||||
const axios = require('axios');
|
||||
const passport = require('passport');
|
||||
const jwtDecode = require('jsonwebtoken/decode');
|
||||
const { Issuer, Strategy: OpenIDStrategy } = require('openid-client');
|
||||
const { logger } = require('~/config');
|
||||
const User = require('~/models/User');
|
||||
|
|
@ -44,7 +45,9 @@ async function setupOpenId() {
|
|||
client_secret: process.env.OPENID_CLIENT_SECRET,
|
||||
redirect_uris: [process.env.DOMAIN_SERVER + process.env.OPENID_CALLBACK_URL],
|
||||
});
|
||||
|
||||
const requiredRole = process.env.OPENID_REQUIRED_ROLE;
|
||||
const requiredRoleParameterPath = process.env.OPENID_REQUIRED_ROLE_PARAMETER_PATH;
|
||||
const requiredRoleTokenKind = process.env.OPENID_REQUIRED_ROLE_TOKEN_KIND;
|
||||
const openidLogin = new OpenIDStrategy(
|
||||
{
|
||||
client,
|
||||
|
|
@ -71,6 +74,36 @@ async function setupOpenId() {
|
|||
fullName = userinfo.username || userinfo.email;
|
||||
}
|
||||
|
||||
if (requiredRole) {
|
||||
let decodedToken = '';
|
||||
if (requiredRoleTokenKind === 'access') {
|
||||
decodedToken = jwtDecode(tokenset.access_token);
|
||||
} else if (requiredRoleTokenKind === 'id') {
|
||||
decodedToken = jwtDecode(tokenset.id_token);
|
||||
}
|
||||
const pathParts = requiredRoleParameterPath.split('.');
|
||||
let found = true;
|
||||
let roles = pathParts.reduce((o, key) => {
|
||||
if (o === null || o === undefined || !(key in o)) {
|
||||
found = false;
|
||||
return [];
|
||||
}
|
||||
return o[key];
|
||||
}, decodedToken);
|
||||
|
||||
if (!found) {
|
||||
console.error(
|
||||
`Key '${requiredRoleParameterPath}' not found in ${requiredRoleTokenKind} token!`,
|
||||
);
|
||||
}
|
||||
|
||||
if (!roles.includes(requiredRole)) {
|
||||
return done(null, false, {
|
||||
message: `You must have the "${requiredRole}" role to log in.`,
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
if (!user) {
|
||||
user = new User({
|
||||
provider: 'openid',
|
||||
|
|
|
|||
114
docs/install/configuration/OAuth2-and-OIDC/aws.md
Normal file
114
docs/install/configuration/OAuth2-and-OIDC/aws.md
Normal file
|
|
@ -0,0 +1,114 @@
|
|||
---
|
||||
title: AWS Cognito
|
||||
description: Learn how to configure LibreChat to use AWS Cognito for user authentication.
|
||||
weight: -7
|
||||
---
|
||||
|
||||
# AWS Cognito
|
||||
|
||||
## Create a new User Pool in Cognito
|
||||
|
||||
- Visit: **[https://console.aws.amazon.com/cognito/](https://console.aws.amazon.com/cognito/)**
|
||||
- Sign in as Root User
|
||||
- Click on `Create user pool`
|
||||
|
||||
|
||||
|
||||
## Configure sign-in experience
|
||||
|
||||
Your Cognito user pool sign-in options should include `User Name` and `Email`.
|
||||
|
||||
|
||||
|
||||
## Configure Security Requirements
|
||||
|
||||
You can configure the password requirements now if you desire
|
||||
|
||||
|
||||
|
||||
## Configure sign-up experience
|
||||
|
||||
Choose the attributes required at signup. The minimum required is `name`. If you want to require users to use their full name at sign up use: `given_name` and `family_name` as required attributes.
|
||||
|
||||
|
||||
|
||||
## Configure message delivery
|
||||
|
||||
Send email with Cognito can be used for free for up to 50 emails a day
|
||||
|
||||
|
||||
|
||||
## Integrate your app
|
||||
|
||||
Select `Use Cognitio Hosted UI` and chose a domain name
|
||||
|
||||
|
||||
|
||||
Set the app type to `Confidential client`
|
||||
Make sure `Generate a client secret` is set.
|
||||
Set the `Allowed callback URLs` to `https://YOUR_DOMAIN/oauth/openid/callback`
|
||||
|
||||
|
||||
|
||||
Under `Advanced app client settings` make sure `Profile` is included in the `OpenID Connect scopes` (in the bottom)
|
||||
|
||||
|
||||
|
||||
## Review and create
|
||||
You can now make last minute changes, click on `Create user pool` when you're done reviewing the configuration
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Get your environment variables
|
||||
|
||||
1. Open your User Pool
|
||||
|
||||
|
||||
|
||||
2. The `User Pool ID` and your AWS region will be used to construct the `OPENID_ISSUER` (see below)
|
||||
|
||||
|
||||
|
||||
|
||||
3. Go to the `App Integrations` tab
|
||||
|
||||
|
||||
|
||||
4. Open the app client
|
||||
|
||||
|
||||
|
||||
5. Toggle `Show Client Secret`
|
||||
|
||||
|
||||
|
||||
- Use the `Client ID` for `OPENID_CLIENT_ID`
|
||||
|
||||
- Use the `Client secret` for `OPENID_CLIENT_SECRET`
|
||||
|
||||
- Generate a random string for the `OPENID_SESSION_SECRET`
|
||||
|
||||
> The `OPENID_SCOPE` and `OPENID_CALLBACK_URL` are pre-configured with the correct values
|
||||
|
||||
6. Open the `.env` file at the root of your LibreChat folder and add the following variables with the values you copied:
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
|
||||
OPENID_CLIENT_ID=Your client ID
|
||||
OPENID_CLIENT_SECRET=Your client secret
|
||||
OPENID_ISSUER=https://cognito-idp.[AWS REGION].amazonaws.com/[USER POOL ID]/.well-known/openid-configuration
|
||||
OPENID_SESSION_SECRET=Any random string
|
||||
OPENID_SCOPE=openid profile email
|
||||
OPENID_CALLBACK_URL=/oauth/openid/callback
|
||||
```
|
||||
7. Save the .env file
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
59
docs/install/configuration/OAuth2-and-OIDC/azure.md
Normal file
59
docs/install/configuration/OAuth2-and-OIDC/azure.md
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
---
|
||||
title: Azure Entra
|
||||
description: Learn how to configure LibreChat to use Azure Entra for user authentication.
|
||||
weight: -6
|
||||
---
|
||||
|
||||
# OpenID with Azure Entra
|
||||
|
||||
1. Go to the [Azure Portal](https://portal.azure.com/) and sign in with your account.
|
||||
2. In the search box, type "Azure Entra" and click on it.
|
||||
3. On the left menu, click on App registrations and then on New registration.
|
||||
4. Give your app a name and select Web as the platform type.
|
||||
5. In the Redirect URI field, enter `http://localhost:3080/oauth/openid/callback` and click on Register.
|
||||
|
||||
|
||||
|
||||
6. You will see an Overview page with some information about your app. Copy the Application (client) ID and the
|
||||
Directory (tenant) ID and save them somewhere.
|
||||
|
||||
|
||||
|
||||
7. On the left menu, click on Authentication and check the boxes for Access tokens and ID tokens under Implicit
|
||||
grant and hybrid flows.
|
||||
|
||||
|
||||
|
||||
8. On the left menu, click on Certificates & Secrets and then on New client secret. Give your secret a
|
||||
name and an expiration date and click on Add. You will see a Value column with your secret. Copy it and
|
||||
save it somewhere. Don't share it with anyone!
|
||||
|
||||
|
||||
|
||||
9. If you want to restrict access by groups you should add the groups claim to the token. To do this, go to
|
||||
Token configuration and click on Add group claim. Select the groups you want to include in the token and click on Add.
|
||||
|
||||
|
||||
|
||||
10. Open the .env file in your project folder and add the following variables with the values you copied:
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
|
||||
OPENID_CLIENT_ID=Your Application (client) ID
|
||||
OPENID_CLIENT_SECRET=Your client secret
|
||||
OPENID_ISSUER=https://login.microsoftonline.com/Your Directory (tenant ID)/v2.0/
|
||||
OPENID_SESSION_SECRET=Any random string
|
||||
OPENID_SCOPE=openid profile email #DO NOT CHANGE THIS
|
||||
OPENID_CALLBACK_URL=/oauth/openid/callback # this should be the same for everyone
|
||||
|
||||
# If you want to restrict access by groups
|
||||
OPENID_REQUIRED_ROLE_TOKEN_KIND=id
|
||||
OPENID_REQUIRED_ROLE_PARAMETER_PATH="roles"
|
||||
OPENID_REQUIRED_ROLE="Your Group Name"
|
||||
```
|
||||
11. Save the .env file
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
|
||||
49
docs/install/configuration/OAuth2-and-OIDC/discord.md
Normal file
49
docs/install/configuration/OAuth2-and-OIDC/discord.md
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
---
|
||||
title: Discord
|
||||
description: Learn how to configure LibreChat to use Discord for user authentication.
|
||||
weight: -11
|
||||
---
|
||||
|
||||
# Discord
|
||||
|
||||
## Create a new Discord Application
|
||||
|
||||
- Go to **[Discord Developer Portal](https://discord.com/developers)**
|
||||
|
||||
- Create a new Application and give it a name
|
||||
|
||||
|
||||
|
||||
## Discord Application Configuration
|
||||
|
||||
- In the OAuth2 general settings add a valid redirect URL:
|
||||
- Example for localhost: `http://localhost:3080/oauth/discord/callback`
|
||||
- Example for a domain: `https://example.com/oauth/discord/callback`
|
||||
|
||||
|
||||
|
||||
- In `Default Authorization Link`, select `In-app Authorization` and set the scopes to `applications.commands`
|
||||
|
||||
|
||||
|
||||
- Save changes and reset the Client Secret
|
||||
|
||||
|
||||
|
||||
|
||||
## .env Configuration
|
||||
|
||||
- Paste your `Client ID` and `Client Secret` in the `.env` file:
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
|
||||
DISCORD_CLIENT_ID=your_client_id
|
||||
DISCORD_CLIENT_SECRET=your_client_secret
|
||||
DISCORD_CALLBACK_URL=/oauth/discord/callback
|
||||
```
|
||||
|
||||
- Save the `.env` file
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
83
docs/install/configuration/OAuth2-and-OIDC/facebook.md
Normal file
83
docs/install/configuration/OAuth2-and-OIDC/facebook.md
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
---
|
||||
title: Facebook
|
||||
description: Learn how to configure LibreChat to use Facebook for user authentication.
|
||||
weight: -8
|
||||
---
|
||||
|
||||
# Facebook - WIP
|
||||
|
||||
> ⚠️ **Warning: Work in progress, not currently functional**
|
||||
|
||||
> ❗ Note: Facebook Authentication will not work from `localhost`
|
||||
|
||||
## Create a Facebook Application
|
||||
|
||||
- Go to the **[Facebook Developer Portal](https://developers.facebook.com/)**
|
||||
|
||||
- Click on "My Apps" in the header menu
|
||||
|
||||
|
||||
|
||||
- Create a new application
|
||||
|
||||
|
||||
|
||||
- Select "Authenticate and request data from users with Facebook Login"
|
||||
|
||||
|
||||
|
||||
- Choose "No, I'm not creating a game"
|
||||
|
||||
|
||||
|
||||
- Provide an `app name` and `App contact email` and click `Create app`
|
||||
|
||||
|
||||
|
||||
## Facebook Application Configuration
|
||||
|
||||
- In the side menu, select "Use cases" and click "Customize" under "Authentication and account creation."
|
||||
|
||||
|
||||
|
||||
- Add the `email permission`
|
||||
|
||||
|
||||
|
||||
- Now click `Go to settings`
|
||||
|
||||
|
||||
|
||||
- Ensure that `Client OAuth login`, `Web OAuth login` and `Enforce HTTPS` are **enabled**.
|
||||
|
||||
|
||||
|
||||
- Add a `Valid OAuth Redirect URIs` and "Save changes"
|
||||
- Example for a domain: `https://example.com/oauth/facebook/callback`
|
||||
|
||||
|
||||
|
||||
- Click `Go back` and select `Basic` in the `App settings` tab
|
||||
|
||||
|
||||
|
||||
- Click "Show" next to the App secret.
|
||||
|
||||
|
||||
|
||||
## .env Configuration
|
||||
|
||||
- Copy the `App ID` and `App Secret` and paste them into the `.env` file as follows:
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
|
||||
FACEBOOK_CLIENT_ID=your_app_id
|
||||
FACEBOOK_CLIENT_SECRET=your_app_secret
|
||||
FACEBOOK_CALLBACK_URL=/oauth/facebook/callback
|
||||
```
|
||||
|
||||
- Save the `.env` file.
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
65
docs/install/configuration/OAuth2-and-OIDC/github.md
Normal file
65
docs/install/configuration/OAuth2-and-OIDC/github.md
Normal file
|
|
@ -0,0 +1,65 @@
|
|||
---
|
||||
title: GitHub
|
||||
description: Learn how to configure LibreChat to use GitHub for user authentication.
|
||||
weight: -10
|
||||
---
|
||||
|
||||
# GitHub
|
||||
|
||||
## Create a GitHub Application
|
||||
|
||||
- Go to your **[Github Developer settings](https://github.com/settings/apps)**
|
||||
- Create a new Github app
|
||||
|
||||
|
||||
|
||||
## GitHub Application Configuration
|
||||
|
||||
- Give it a `GitHub App name` and set your `Homepage URL`
|
||||
- Example for localhost: `http://localhost:3080`
|
||||
- Example for a domain: `https://example.com`
|
||||
|
||||
|
||||
|
||||
- Add a valid `Callback URL`:
|
||||
- Example for localhost: `http://localhost:3080/oauth/github/callback`
|
||||
- Example for a domain: `https://example.com/oauth/github/callback`
|
||||
|
||||
|
||||
|
||||
- Uncheck the box labeled `Active` in the `Webhook` section
|
||||
|
||||
|
||||
|
||||
- Scroll down to `Account permissions` and set `Email addresses` to `Access: Read-only`
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- Click on `Create GitHub App`
|
||||
|
||||
|
||||
|
||||
## .env Configuration
|
||||
|
||||
- Click `Generate a new client secret`
|
||||
|
||||
|
||||
|
||||
- Copy the `Client ID` and `Client Secret` in the `.env` file
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
|
||||
GITHUB_CLIENT_ID=your_client_id
|
||||
GITHUB_CLIENT_SECRET=your_client_secret
|
||||
GITHUB_CALLBACK_URL=/oauth/github/callback
|
||||
```
|
||||
|
||||
- Save the `.env` file
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
97
docs/install/configuration/OAuth2-and-OIDC/google.md
Normal file
97
docs/install/configuration/OAuth2-and-OIDC/google.md
Normal file
|
|
@ -0,0 +1,97 @@
|
|||
---
|
||||
title: Google
|
||||
description: Learn how to configure LibreChat to use Google for user authentication.
|
||||
weight: -9
|
||||
---
|
||||
|
||||
# Google
|
||||
|
||||
## Create a Google Application
|
||||
|
||||
- Visit: **[Google Cloud Console](https://cloud.google.com)** and open the `Console`
|
||||
|
||||
|
||||
|
||||
- Create a New Project and give it a name
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Google Application Configuration
|
||||
|
||||
- Select the project you just created and go to `APIs and Services`
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- Select `Credentials` and click `CONFIGURE CONSENT SCREEN`
|
||||
|
||||
|
||||
|
||||
- Select `External` then click `CREATE`
|
||||
|
||||
|
||||
|
||||
- Fill in your App information
|
||||
|
||||
> Note: You can get a logo from your LibreChat folder here: `docs\assets\favicon_package\android-chrome-192x192.png`
|
||||
|
||||
|
||||
|
||||
- Configure your `App domain` and add your `Developer contact information` then click `SAVE AND CONTINUE`
|
||||
|
||||
|
||||
|
||||
- Configure the `Sopes`
|
||||
- Add `email`,`profile` and `openid`
|
||||
- Click `UPDATE` and `SAVE AND CONTINUE`
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- Click `SAVE AND CONTINUE`
|
||||
- Review your app and go back to dashboard
|
||||
|
||||
- Go back to the `Credentials` tab, click on `+ CREATE CREDENTIALS` and select `OAuth client ID`
|
||||
|
||||
|
||||
|
||||
- Select `Web application` and give it a name
|
||||
|
||||
|
||||
|
||||
- Configure the `Authorized JavaScript origins`, you can add both your domain and localhost if you desire
|
||||
- Example for localhost: `http://localhost:3080`
|
||||
- Example for a domain: `https://example.com`
|
||||
|
||||
|
||||
|
||||
- Add a valid `Authorized redirect URIs`
|
||||
- Example for localhost: `http://localhost:3080/oauth/google/callback`
|
||||
- Example for a domain: `https://example.com/oauth/google/callback`
|
||||
|
||||
|
||||
|
||||
## .env Configuration
|
||||
|
||||
- Click `CREATE` and copy your `Client ID` and `Client secret`
|
||||
|
||||
|
||||
|
||||
- Add them to your `.env` file:
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||
|
||||
GOOGLE_CLIENT_ID=your_client_id
|
||||
GOOGLE_CLIENT_SECRET=your_client_secret
|
||||
GOOGLE_CALLBACK_URL=/oauth/github/callback
|
||||
```
|
||||
|
||||
- Save the `.env` file
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
68
docs/install/configuration/OAuth2-and-OIDC/keycloak.md
Normal file
68
docs/install/configuration/OAuth2-and-OIDC/keycloak.md
Normal file
|
|
@ -0,0 +1,68 @@
|
|||
---
|
||||
title: Keycloak
|
||||
description: Learn how to configure LibreChat to use Keycloak for user authentication.
|
||||
weight: -5
|
||||
---
|
||||
|
||||
# Keycloak
|
||||
|
||||
1. **Access Keycloak Admin Console:**
|
||||
- Open the Keycloak Admin Console in your web browser. This is usually
|
||||
found at a URL like `http://localhost:8080/auth/admin/`.
|
||||
|
||||
2. **Create a Realm (if necessary):**
|
||||
- If you don't already have a realm for your application, create one. Click on 'Add Realm' and give it a name.
|
||||
|
||||
3. **Create a Client:**
|
||||
- Within your realm, click on 'Clients' and then 'Create'.
|
||||
- Enter a client ID and select 'openid-connect' as the Client Protocol.
|
||||
- Set 'Client Authentication' to 'On'.
|
||||
- In 'Valid Redirect URIs', enter `http://localhost:3080/oauth/openid/callback` or the appropriate URI for
|
||||
your application.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
4. **Configure Client:**
|
||||
- After creating the client, you will be redirected to its settings page.
|
||||
- Note the 'Client ID' and 'Secret' from the 'Credentials' tab – you'll need these for your application.
|
||||
|
||||
|
||||
|
||||
|
||||
5. **Add Roles (Optional):**
|
||||
If you want to restrict access to users with specific roles, you can define roles in Keycloak and assign them to users.
|
||||
- Go to the 'Roles' tab in your client or realm (depending on where you want to define the roles).
|
||||
- Create a new role that matches the value you have in `OPENID_REQUIRED_ROLE`.
|
||||
|
||||
|
||||
|
||||
6. **Assign Roles to Users (Optional):**
|
||||
- Go to 'Users', select a user, and go to the 'Role Mappings' tab.
|
||||
- Assign the appropriate role (that matches `OPENID_REQUIRED_ROLE`) to the user.
|
||||
|
||||
|
||||
|
||||
7. **Get path of roles list inside token (Optional):**
|
||||
- Decode your jwtToken from OpenID provider and determine path for roles list inside access token. For example, if you are
|
||||
using Keycloak, the path is `realm_access.roles`.
|
||||
- Put this path in `OPENID_REQUIRED_ROLE_PARAMETER_PATH` variable in `.env` file.
|
||||
- By parameter `OPENID_REQUIRED_ROLE_TOKEN_KIND` you can specify which token kind you want to use.
|
||||
Possible values are `access` and `id`.
|
||||
|
||||
8**Update Your Project's Configuration:**
|
||||
- Open the `.env` file in your project folder and add the following variables:
|
||||
```
|
||||
OPENID_ISSUER=http://localhost:8080/auth/realms/[YourRealmName]
|
||||
OPENID_CLIENT_ID=[YourClientID]
|
||||
OPENID_CLIENT_SECRET=[YourClientSecret]
|
||||
OPENID_CALLBACK_URL=http://localhost:3080/oauth/openid/callback
|
||||
OPENID_SCOPE="openid profile email"
|
||||
OPENID_REQUIRED_ROLE=[YourRequiredRole]
|
||||
OPENID_REQUIRED_ROLE_TOKEN_KIND=(access|id)
|
||||
OPENID_REQUIRED_ROLE_PARAMETER_PATH="realm_access.roles"
|
||||
```
|
||||
|
|
@ -16,7 +16,7 @@ Alternatively, you can create a new file named `docker-compose.override.yml` in
|
|||
For more info see:
|
||||
|
||||
- Our quick guide:
|
||||
- **[Docker Override](../configuration/docker_override.md)**
|
||||
- **[Docker Override](./docker_override.md)**
|
||||
|
||||
- The official docker documentation:
|
||||
- **[docker docs - understanding-multiple-compose-files](https://docs.docker.com/compose/multiple-compose-files/extends/#understanding-multiple-compose-files)**
|
||||
|
|
@ -274,7 +274,7 @@ DALLE2_API_KEY=your-azure-api-key-for-dall-e-2
|
|||
### BingAI
|
||||
Bing, also used for Sydney, jailbreak, and Bing Image Creator, see: [Bing Access token](./ai_setup.md#bingai) and [Bing Jailbreak](../../features/bing_jailbreak.md)
|
||||
|
||||
- Follow these instructions to get your bing access token (it's best to use the full cookie string for that purpose): **[Bing Access Token](../configuration/ai_setup.md#bingai)**
|
||||
- Follow these instructions to get your bing access token (it's best to use the full cookie string for that purpose): **[Bing Access Token](./ai_setup.md#bingai)**
|
||||
- Leave `BINGAI_TOKEN=` blank to disable this endpoint
|
||||
- Set `BINGAI_TOKEN=` to "user_provided" to allow users to provide their own API key from the WebUI
|
||||
|
||||
|
|
@ -719,7 +719,7 @@ CHECK_BALANCE=false
|
|||
```
|
||||
|
||||
### Registration and Login
|
||||
see: **[User/Auth System](../configuration/user_auth_system.md)**
|
||||
see: **[User/Auth System](./user_auth_system.md)**
|
||||
|
||||
|
||||
|
||||
|
|
@ -757,9 +757,9 @@ JWT_REFRESH_SECRET=eaa5191f2914e30b9387fd84e254e4ba6fc51b4654968a9b0803b456a54b8
|
|||
|
||||
### Social Logins
|
||||
|
||||
#### [Discord Authentication](../configuration/user_auth_system.md#discord)
|
||||
#### [Discord Authentication](./OAuth2-and-OIDC/discord.md)
|
||||
|
||||
for more information: **[Discord](../configuration/user_auth_system.md#discord)**
|
||||
for more information: **[Discord](./OAuth2-and-OIDC/discord.md)**
|
||||
|
||||
```bash
|
||||
# Discord
|
||||
|
|
@ -768,9 +768,9 @@ DISCORD_CLIENT_SECRET=your_client_secret
|
|||
DISCORD_CALLBACK_URL=/oauth/discord/callback
|
||||
```
|
||||
|
||||
#### [Facebook Authentication](../configuration/user_auth_system.md#facebook)
|
||||
#### [Facebook Authentication](./OAuth2-and-OIDC/facebook.md)
|
||||
|
||||
for more information: **[Facebook Authentication](../configuration/user_auth_system.md#facebook)**
|
||||
for more information: **[Facebook Authentication](./OAuth2-and-OIDC/facebook.md)**
|
||||
|
||||
```bash
|
||||
# Facebook
|
||||
|
|
@ -779,9 +779,9 @@ FACEBOOK_CLIENT_SECRET=
|
|||
FACEBOOK_CALLBACK_URL=/oauth/facebook/callback
|
||||
|
||||
```
|
||||
#### [GitHub Authentication](../configuration/user_auth_system.md#github)
|
||||
#### [GitHub Authentication](./OAuth2-and-OIDC/github.md)
|
||||
|
||||
for more information: **[GitHub Authentication](../configuration/user_auth_system.md#github)**
|
||||
for more information: **[GitHub Authentication](./OAuth2-and-OIDC/github.md)**
|
||||
|
||||
```bash
|
||||
# GitHub
|
||||
|
|
@ -790,9 +790,9 @@ GITHUB_CLIENT_SECRET=your_client_secret
|
|||
GITHUB_CALLBACK_URL=/oauth/github/callback
|
||||
```
|
||||
|
||||
#### [Google Authentication](../configuration/user_auth_system.md#google)
|
||||
#### [Google Authentication](./OAuth2-and-OIDC/google.md)
|
||||
|
||||
for more information: **[Google Authentication](../configuration/user_auth_system.md#google)**
|
||||
for more information: **[Google Authentication](./OAuth2-and-OIDC/google.md)**
|
||||
|
||||
```bash
|
||||
# Google
|
||||
|
|
@ -801,9 +801,9 @@ GOOGLE_CLIENT_SECRET=
|
|||
GOOGLE_CALLBACK_URL=/oauth/google/callback
|
||||
```
|
||||
|
||||
#### [OpenID Authentication](../configuration/user_auth_system.md#openid-with-aws-cognito)
|
||||
#### [OpenID Authentication](./OAuth2-and-OIDC/aws.md)
|
||||
|
||||
for more information: **[Azure OpenID Authentication](../configuration/user_auth_system.md#openid-with-azure-ad)** or **[AWS Cognito OpenID Authentication](../configuration/user_auth_system.md#openid-with-aws-cognito)**
|
||||
for more information: **[Azure OpenID Authentication](./OAuth2-and-OIDC/azure.md)** or **[AWS Cognito OpenID Authentication](./OAuth2-and-OIDC/aws.md)**
|
||||
|
||||
```bash
|
||||
# OpenID
|
||||
|
|
@ -813,13 +813,15 @@ OPENID_ISSUER=
|
|||
OPENID_SESSION_SECRET=
|
||||
OPENID_SCOPE="openid profile email"
|
||||
OPENID_CALLBACK_URL=/oauth/openid/callback
|
||||
|
||||
OPENID_BUTTON_LABEL=
|
||||
OPENID_IMAGE_URL=
|
||||
OPENID_REQUIRED_ROLE_TOKEN_KIND=
|
||||
OPENID_REQUIRED_ROLE=
|
||||
OPENID_REQUIRED_ROLE_PARAMETER_PATH=
|
||||
```
|
||||
|
||||
### Email Password Reset
|
||||
Email is used for password reset. See: **[Email Password Reset](../configuration/user_auth_system.md#email-and-password-reset)**
|
||||
Email is used for password reset. See: **[Email Password Reset](./user_auth_system.md#email-and-password-reset)**
|
||||
|
||||
- Note that all either service or host, username and password and the From address must be set for email to work.
|
||||
|
||||
|
|
|
|||
|
|
@ -166,431 +166,16 @@ EMAIL_FROM_NAME="My LibreChat Server"
|
|||
|
||||
---
|
||||
|
||||
## Social Authentication - Setup and Configuration
|
||||
## Social Authentication
|
||||
|
||||
|
||||
|
||||
### Discord
|
||||
|
||||
#### Create a new Discord Application
|
||||
|
||||
- Go to **[Discord Developer Portal](https://discord.com/developers)**
|
||||
|
||||
- Create a new Application and give it a name
|
||||
|
||||
|
||||
|
||||
#### Discord Application Configuration
|
||||
|
||||
- In the OAuth2 general settings add a valid redirect URL:
|
||||
- Example for localhost: `http://localhost:3080/oauth/discord/callback`
|
||||
- Example for a domain: `https://example.com/oauth/discord/callback`
|
||||
|
||||
|
||||
|
||||
- In `Default Authorization Link`, select `In-app Authorization` and set the scopes to `applications.commands`
|
||||
|
||||
|
||||
|
||||
- Save changes and reset the Client Secret
|
||||
|
||||
|
||||
|
||||
|
||||
#### .env Configuration
|
||||
|
||||
- Paste your `Client ID` and `Client Secret` in the `.env` file:
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
|
||||
DISCORD_CLIENT_ID=your_client_id
|
||||
DISCORD_CLIENT_SECRET=your_client_secret
|
||||
DISCORD_CALLBACK_URL=/oauth/discord/callback
|
||||
```
|
||||
|
||||
- Save the `.env` file
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
|
||||
---
|
||||
|
||||
### Facebook - WIP
|
||||
|
||||
> ⚠️ **Warning: Work in progress, not currently functional**
|
||||
|
||||
> ❗ Note: Facebook Authentication will not work from `localhost`
|
||||
|
||||
#### Create a Facebook Application
|
||||
|
||||
- Go to the **[Facebook Developer Portal](https://developers.facebook.com/)**
|
||||
|
||||
- Click on "My Apps" in the header menu
|
||||
|
||||
|
||||
|
||||
- Create a new application
|
||||
|
||||
|
||||
|
||||
- Select "Authenticate and request data from users with Facebook Login"
|
||||
|
||||
|
||||
|
||||
- Choose "No, I'm not creating a game"
|
||||
|
||||
|
||||
|
||||
- Provide an `app name` and `App contact email` and click `Create app`
|
||||
|
||||
|
||||
|
||||
#### Facebook Application Configuration
|
||||
|
||||
- In the side menu, select "Use cases" and click "Customize" under "Authentication and account creation."
|
||||
|
||||
|
||||
|
||||
- Add the `email permission`
|
||||
|
||||
|
||||
|
||||
- Now click `Go to settings`
|
||||
|
||||
|
||||
|
||||
- Ensure that `Client OAuth login`, `Web OAuth login` and `Enforce HTTPS` are **enabled**.
|
||||
|
||||
|
||||
|
||||
- Add a `Valid OAuth Redirect URIs` and "Save changes"
|
||||
- Example for a domain: `https://example.com/oauth/facebook/callback`
|
||||
|
||||
|
||||
|
||||
- Click `Go back` and select `Basic` in the `App settings` tab
|
||||
|
||||
|
||||
|
||||
- Click "Show" next to the App secret.
|
||||
|
||||
|
||||
|
||||
#### .env Configuration
|
||||
|
||||
- Copy the `App ID` and `App Secret` and paste them into the `.env` file as follows:
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
|
||||
FACEBOOK_CLIENT_ID=your_app_id
|
||||
FACEBOOK_CLIENT_SECRET=your_app_secret
|
||||
FACEBOOK_CALLBACK_URL=/oauth/facebook/callback
|
||||
```
|
||||
|
||||
- Save the `.env` file.
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
|
||||
---
|
||||
|
||||
### GitHub
|
||||
|
||||
#### Create a GitHub Application
|
||||
|
||||
- Go to your **[Github Developer settings](https://github.com/settings/apps)**
|
||||
- Create a new Github app
|
||||
|
||||
|
||||
|
||||
#### GitHub Application Configuration
|
||||
|
||||
- Give it a `GitHub App name` and set your `Homepage URL`
|
||||
- Example for localhost: `http://localhost:3080`
|
||||
- Example for a domain: `https://example.com`
|
||||
|
||||
|
||||
|
||||
- Add a valid `Callback URL`:
|
||||
- Example for localhost: `http://localhost:3080/oauth/github/callback`
|
||||
- Example for a domain: `https://example.com/oauth/github/callback`
|
||||
|
||||
|
||||
|
||||
- Uncheck the box labeled `Active` in the `Webhook` section
|
||||
|
||||
|
||||
|
||||
- Scroll down to `Account permissions` and set `Email addresses` to `Access: Read-only`
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- Click on `Create GitHub App`
|
||||
|
||||
|
||||
|
||||
#### .env Configuration
|
||||
|
||||
- Click `Generate a new client secret`
|
||||
|
||||
|
||||
|
||||
- Copy the `Client ID` and `Client Secret` in the `.env` file
|
||||
|
||||
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
|
||||
GITHUB_CLIENT_ID=your_client_id
|
||||
GITHUB_CLIENT_SECRET=your_client_secret
|
||||
GITHUB_CALLBACK_URL=/oauth/github/callback
|
||||
```
|
||||
|
||||
- Save the `.env` file
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
|
||||
---
|
||||
|
||||
### Google
|
||||
|
||||
#### Create a Google Application
|
||||
|
||||
- Visit: **[Google Cloud Console](https://cloud.google.com)** and open the `Console`
|
||||
|
||||
|
||||
|
||||
- Create a New Project and give it a name
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Google Application Configuration
|
||||
|
||||
- Select the project you just created and go to `APIs and Services`
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- Select `Credentials` and click `CONFIGURE CONSENT SCREEN`
|
||||
|
||||
|
||||
|
||||
- Select `External` then click `CREATE`
|
||||
|
||||
|
||||
|
||||
- Fill in your App information
|
||||
|
||||
> Note: You can get a logo from your LibreChat folder here: `docs\assets\favicon_package\android-chrome-192x192.png`
|
||||
|
||||
|
||||
|
||||
- Configure your `App domain` and add your `Developer contact information` then click `SAVE AND CONTINUE`
|
||||
|
||||
|
||||
|
||||
- Configure the `Sopes`
|
||||
- Add `email`,`profile` and `openid`
|
||||
- Click `UPDATE` and `SAVE AND CONTINUE`
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
- Click `SAVE AND CONTINUE`
|
||||
- Review your app and go back to dashboard
|
||||
|
||||
- Go back to the `Credentials` tab, click on `+ CREATE CREDENTIALS` and select `OAuth client ID`
|
||||
|
||||
|
||||
|
||||
- Select `Web application` and give it a name
|
||||
|
||||
|
||||
|
||||
- Configure the `Authorized JavaScript origins`, you can add both your domain and localhost if you desire
|
||||
- Example for localhost: `http://localhost:3080`
|
||||
- Example for a domain: `https://example.com`
|
||||
|
||||
|
||||
|
||||
- Add a valid `Authorized redirect URIs`
|
||||
- Example for localhost: `http://localhost:3080/oauth/google/callback`
|
||||
- Example for a domain: `https://example.com/oauth/google/callback`
|
||||
|
||||
|
||||
|
||||
#### .env Configuration
|
||||
|
||||
- Click `CREATE` and copy your `Client ID` and `Client secret`
|
||||
|
||||
|
||||
|
||||
- Add them to your `.env` file:
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
|
||||
GOOGLE_CLIENT_ID=your_client_id
|
||||
GOOGLE_CLIENT_SECRET=your_client_secret
|
||||
GOOGLE_CALLBACK_URL=/oauth/github/callback
|
||||
```
|
||||
|
||||
- Save the `.env` file
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
|
||||
---
|
||||
|
||||
### OpenID with AWS Cognito
|
||||
|
||||
#### Create a new User Pool in Cognito
|
||||
|
||||
- Visit: **[https://console.aws.amazon.com/cognito/](https://console.aws.amazon.com/cognito/)**
|
||||
- Sign in as Root User
|
||||
- Click on `Create user pool`
|
||||
|
||||
|
||||
|
||||
#### Configure sign-in experience
|
||||
|
||||
Your Cognito user pool sign-in options should include `User Name` and `Email`.
|
||||
|
||||
|
||||
|
||||
#### Configure Security Requirements
|
||||
|
||||
You can configure the password requirements now if you desire
|
||||
|
||||
|
||||
|
||||
#### Configure sign-up experience
|
||||
|
||||
Choose the attributes required at signup. The minimum required is `name`. If you want to require users to use their full name at sign up use: `given_name` and `family_name` as required attributes.
|
||||
|
||||
|
||||
|
||||
#### Configure message delivery
|
||||
|
||||
Send email with Cognito can be used for free for up to 50 emails a day
|
||||
|
||||
|
||||
|
||||
#### Integrate your app
|
||||
|
||||
Select `Use Cognitio Hosted UI` and chose a domain name
|
||||
|
||||
|
||||
|
||||
Set the app type to `Confidential client`
|
||||
Make sure `Generate a client secret` is set.
|
||||
Set the `Allowed callback URLs` to `https://YOUR_DOMAIN/oauth/openid/callback`
|
||||
|
||||
|
||||
|
||||
Under `Advanced app client settings` make sure `Profile` is included in the `OpenID Connect scopes` (in the bottom)
|
||||
|
||||
|
||||
|
||||
#### Review and create
|
||||
You can now make last minute changes, click on `Create user pool` when you're done reviewing the configuration
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### Get your environment variables
|
||||
|
||||
1. Open your User Pool
|
||||
|
||||
|
||||
|
||||
2. The `User Pool ID` and your AWS region will be used to construct the `OPENID_ISSUER` (see below)
|
||||
|
||||
|
||||
|
||||
|
||||
3. Go to the `App Integrations` tab
|
||||
|
||||
|
||||
|
||||
4. Open the app client
|
||||
|
||||
|
||||
|
||||
5. Toggle `Show Client Secret`
|
||||
|
||||
|
||||
|
||||
- Use the `Client ID` for `OPENID_CLIENT_ID`
|
||||
|
||||
- Use the `Client secret` for `OPENID_CLIENT_SECRET`
|
||||
|
||||
- Generate a random string for the `OPENID_SESSION_SECRET`
|
||||
|
||||
> The `OPENID_SCOPE` and `OPENID_CALLBACK_URL` are pre-configured with the correct values
|
||||
|
||||
6. Open the `.env` file at the root of your LibreChat folder and add the following variables with the values you copied:
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
|
||||
OPENID_CLIENT_ID=Your client ID
|
||||
OPENID_CLIENT_SECRET=Your client secret
|
||||
OPENID_ISSUER=https://cognito-idp.[AWS REGION].amazonaws.com/[USER POOL ID]/.well-known/openid-configuration
|
||||
OPENID_SESSION_SECRET=Any random string
|
||||
OPENID_SCOPE=openid profile email
|
||||
OPENID_CALLBACK_URL=/oauth/openid/callback
|
||||
```
|
||||
7. Save the .env file
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
|
||||
|
||||
---
|
||||
|
||||
### OpenID with Azure AD
|
||||
|
||||
1. Go to the [Azure Portal](https://portal.azure.com/) and sign in with your account.
|
||||
2. In the search box, type "Azure Active Directory" and click on it.
|
||||
3. On the left menu, click on App registrations and then on New registration.
|
||||
4. Give your app a name and select Web as the platform type.
|
||||
5. In the Redirect URI field, enter `http://localhost:3080/oauth/openid/callback` and click on Register.
|
||||
6. You will see an Overview page with some information about your app. Copy the Application (client) ID and the Directory (tenant) ID and save them somewhere.
|
||||
7. On the left menu, click on Authentication and check the boxes for Access tokens and ID tokens under Implicit grant and hybrid flows.
|
||||
8. On the left menu, click on Certificates & Secrets and then on New client secret. Give your secret a name and an expiration date and click on Add.
|
||||
9. You will see a Value column with your secret. Copy it and save it somewhere. Don't share it with anyone!
|
||||
10. Open the .env file in your project folder and add the following variables with the values you copied:
|
||||
|
||||
```bash
|
||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
||||
|
||||
OPENID_CLIENT_ID=Your Application (client) ID
|
||||
OPENID_CLIENT_SECRET=Your client secret
|
||||
OPENID_ISSUER=https://login.microsoftonline.com/Your Directory (tenant ID)/v2.0/
|
||||
OPENID_SESSION_SECRET=Any random string
|
||||
OPENID_SCOPE=openid profile email #DO NOT CHANGE THIS
|
||||
OPENID_CALLBACK_URL=/oauth/openid/callback # this should be the same for everyone
|
||||
```
|
||||
11. Save the .env file
|
||||
|
||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||
|
||||
|
||||
---
|
||||
### OAuth2
|
||||
- [Discord](./OAuth2-and-OIDC/discord.md)
|
||||
- [GitHub](./OAuth2-and-OIDC/github.md)
|
||||
- [Google](./OAuth2-and-OIDC/google.md)
|
||||
- [Facebook](./OAuth2-and-OIDC/facebook.md)
|
||||
### OpenID Connect
|
||||
- [AWS Cognito](./OAuth2-and-OIDC/aws.md)
|
||||
- [Azure Entra/AD](./OAuth2-and-OIDC/azure.md)
|
||||
- [Keycloak](./OAuth2-and-OIDC/keycloak.md)
|
||||
Loading…
Add table
Add a link
Reference in a new issue