mirror of
https://github.com/danny-avila/LibreChat.git
synced 2025-09-22 06:00:56 +02:00
🛂 feat: Required OpenID Role (#2279)
* feat: add possibility to filter by roles for OpenID provider --------- Co-authored-by: Sirius <siriusfrk@gmail.com>
This commit is contained in:
Danny Avila
GitHub
parent
49753a35e5
commit
1bafe80e78
11 changed files with 599 additions and 441 deletions
|
|
@ -316,6 +316,9 @@ OPENID_ISSUER=
|
||||||
OPENID_SESSION_SECRET=
|
OPENID_SESSION_SECRET=
|
||||||
OPENID_SCOPE="openid profile email"
|
OPENID_SCOPE="openid profile email"
|
||||||
OPENID_CALLBACK_URL=/oauth/openid/callback
|
OPENID_CALLBACK_URL=/oauth/openid/callback
|
||||||
|
OPENID_REQUIRED_ROLE=
|
||||||
|
OPENID_REQUIRED_ROLE_TOKEN_KIND=
|
||||||
|
OPENID_REQUIRED_ROLE_PARAMETER_PATH=
|
||||||
|
|
||||||
OPENID_BUTTON_LABEL=
|
OPENID_BUTTON_LABEL=
|
||||||
OPENID_IMAGE_URL=
|
OPENID_IMAGE_URL=
|
||||||
|
|
|
||||||
|
|
@ -2,6 +2,7 @@ const fs = require('fs');
|
||||||
const path = require('path');
|
const path = require('path');
|
||||||
const axios = require('axios');
|
const axios = require('axios');
|
||||||
const passport = require('passport');
|
const passport = require('passport');
|
||||||
|
const jwtDecode = require('jsonwebtoken/decode');
|
||||||
const { Issuer, Strategy: OpenIDStrategy } = require('openid-client');
|
const { Issuer, Strategy: OpenIDStrategy } = require('openid-client');
|
||||||
const { logger } = require('~/config');
|
const { logger } = require('~/config');
|
||||||
const User = require('~/models/User');
|
const User = require('~/models/User');
|
||||||
|
|
@ -44,7 +45,9 @@ async function setupOpenId() {
|
||||||
client_secret: process.env.OPENID_CLIENT_SECRET,
|
client_secret: process.env.OPENID_CLIENT_SECRET,
|
||||||
redirect_uris: [process.env.DOMAIN_SERVER + process.env.OPENID_CALLBACK_URL],
|
redirect_uris: [process.env.DOMAIN_SERVER + process.env.OPENID_CALLBACK_URL],
|
||||||
});
|
});
|
||||||
|
const requiredRole = process.env.OPENID_REQUIRED_ROLE;
|
||||||
|
const requiredRoleParameterPath = process.env.OPENID_REQUIRED_ROLE_PARAMETER_PATH;
|
||||||
|
const requiredRoleTokenKind = process.env.OPENID_REQUIRED_ROLE_TOKEN_KIND;
|
||||||
const openidLogin = new OpenIDStrategy(
|
const openidLogin = new OpenIDStrategy(
|
||||||
{
|
{
|
||||||
client,
|
client,
|
||||||
|
|
@ -71,6 +74,36 @@ async function setupOpenId() {
|
||||||
fullName = userinfo.username || userinfo.email;
|
fullName = userinfo.username || userinfo.email;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (requiredRole) {
|
||||||
|
let decodedToken = '';
|
||||||
|
if (requiredRoleTokenKind === 'access') {
|
||||||
|
decodedToken = jwtDecode(tokenset.access_token);
|
||||||
|
} else if (requiredRoleTokenKind === 'id') {
|
||||||
|
decodedToken = jwtDecode(tokenset.id_token);
|
||||||
|
}
|
||||||
|
const pathParts = requiredRoleParameterPath.split('.');
|
||||||
|
let found = true;
|
||||||
|
let roles = pathParts.reduce((o, key) => {
|
||||||
|
if (o === null || o === undefined || !(key in o)) {
|
||||||
|
found = false;
|
||||||
|
return [];
|
||||||
|
}
|
||||||
|
return o[key];
|
||||||
|
}, decodedToken);
|
||||||
|
|
||||||
|
if (!found) {
|
||||||
|
console.error(
|
||||||
|
`Key '${requiredRoleParameterPath}' not found in ${requiredRoleTokenKind} token!`,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!roles.includes(requiredRole)) {
|
||||||
|
return done(null, false, {
|
||||||
|
message: `You must have the "${requiredRole}" role to log in.`,
|
||||||
|
});
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
if (!user) {
|
if (!user) {
|
||||||
user = new User({
|
user = new User({
|
||||||
provider: 'openid',
|
provider: 'openid',
|
||||||
|
|
|
||||||
114
docs/install/configuration/OAuth2-and-OIDC/aws.md
Normal file
114
docs/install/configuration/OAuth2-and-OIDC/aws.md
Normal file
|
|
@ -0,0 +1,114 @@
|
||||||
|
---
|
||||||
|
title: AWS Cognito
|
||||||
|
description: Learn how to configure LibreChat to use AWS Cognito for user authentication.
|
||||||
|
weight: -7
|
||||||
|
---
|
||||||
|
|
||||||
|
# AWS Cognito
|
||||||
|
|
||||||
|
## Create a new User Pool in Cognito
|
||||||
|
|
||||||
|
- Visit: **[https://console.aws.amazon.com/cognito/](https://console.aws.amazon.com/cognito/)**
|
||||||
|
- Sign in as Root User
|
||||||
|
- Click on `Create user pool`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Configure sign-in experience
|
||||||
|
|
||||||
|
Your Cognito user pool sign-in options should include `User Name` and `Email`.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Configure Security Requirements
|
||||||
|
|
||||||
|
You can configure the password requirements now if you desire
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Configure sign-up experience
|
||||||
|
|
||||||
|
Choose the attributes required at signup. The minimum required is `name`. If you want to require users to use their full name at sign up use: `given_name` and `family_name` as required attributes.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Configure message delivery
|
||||||
|
|
||||||
|
Send email with Cognito can be used for free for up to 50 emails a day
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Integrate your app
|
||||||
|
|
||||||
|
Select `Use Cognitio Hosted UI` and chose a domain name
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Set the app type to `Confidential client`
|
||||||
|
Make sure `Generate a client secret` is set.
|
||||||
|
Set the `Allowed callback URLs` to `https://YOUR_DOMAIN/oauth/openid/callback`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Under `Advanced app client settings` make sure `Profile` is included in the `OpenID Connect scopes` (in the bottom)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Review and create
|
||||||
|
You can now make last minute changes, click on `Create user pool` when you're done reviewing the configuration
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Get your environment variables
|
||||||
|
|
||||||
|
1. Open your User Pool
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
2. The `User Pool ID` and your AWS region will be used to construct the `OPENID_ISSUER` (see below)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
3. Go to the `App Integrations` tab
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
4. Open the app client
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
5. Toggle `Show Client Secret`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Use the `Client ID` for `OPENID_CLIENT_ID`
|
||||||
|
|
||||||
|
- Use the `Client secret` for `OPENID_CLIENT_SECRET`
|
||||||
|
|
||||||
|
- Generate a random string for the `OPENID_SESSION_SECRET`
|
||||||
|
|
||||||
|
> The `OPENID_SCOPE` and `OPENID_CALLBACK_URL` are pre-configured with the correct values
|
||||||
|
|
||||||
|
6. Open the `.env` file at the root of your LibreChat folder and add the following variables with the values you copied:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
|
||||||
|
OPENID_CLIENT_ID=Your client ID
|
||||||
|
OPENID_CLIENT_SECRET=Your client secret
|
||||||
|
OPENID_ISSUER=https://cognito-idp.[AWS REGION].amazonaws.com/[USER POOL ID]/.well-known/openid-configuration
|
||||||
|
OPENID_SESSION_SECRET=Any random string
|
||||||
|
OPENID_SCOPE=openid profile email
|
||||||
|
OPENID_CALLBACK_URL=/oauth/openid/callback
|
||||||
|
```
|
||||||
|
7. Save the .env file
|
||||||
|
|
||||||
|
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||||
59
docs/install/configuration/OAuth2-and-OIDC/azure.md
Normal file
59
docs/install/configuration/OAuth2-and-OIDC/azure.md
Normal file
|
|
@ -0,0 +1,59 @@
|
||||||
|
---
|
||||||
|
title: Azure Entra
|
||||||
|
description: Learn how to configure LibreChat to use Azure Entra for user authentication.
|
||||||
|
weight: -6
|
||||||
|
---
|
||||||
|
|
||||||
|
# OpenID with Azure Entra
|
||||||
|
|
||||||
|
1. Go to the [Azure Portal](https://portal.azure.com/) and sign in with your account.
|
||||||
|
2. In the search box, type "Azure Entra" and click on it.
|
||||||
|
3. On the left menu, click on App registrations and then on New registration.
|
||||||
|
4. Give your app a name and select Web as the platform type.
|
||||||
|
5. In the Redirect URI field, enter `http://localhost:3080/oauth/openid/callback` and click on Register.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
6. You will see an Overview page with some information about your app. Copy the Application (client) ID and the
|
||||||
|
Directory (tenant) ID and save them somewhere.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
7. On the left menu, click on Authentication and check the boxes for Access tokens and ID tokens under Implicit
|
||||||
|
grant and hybrid flows.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
8. On the left menu, click on Certificates & Secrets and then on New client secret. Give your secret a
|
||||||
|
name and an expiration date and click on Add. You will see a Value column with your secret. Copy it and
|
||||||
|
save it somewhere. Don't share it with anyone!
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
9. If you want to restrict access by groups you should add the groups claim to the token. To do this, go to
|
||||||
|
Token configuration and click on Add group claim. Select the groups you want to include in the token and click on Add.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
10. Open the .env file in your project folder and add the following variables with the values you copied:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
|
||||||
|
OPENID_CLIENT_ID=Your Application (client) ID
|
||||||
|
OPENID_CLIENT_SECRET=Your client secret
|
||||||
|
OPENID_ISSUER=https://login.microsoftonline.com/Your Directory (tenant ID)/v2.0/
|
||||||
|
OPENID_SESSION_SECRET=Any random string
|
||||||
|
OPENID_SCOPE=openid profile email #DO NOT CHANGE THIS
|
||||||
|
OPENID_CALLBACK_URL=/oauth/openid/callback # this should be the same for everyone
|
||||||
|
|
||||||
|
# If you want to restrict access by groups
|
||||||
|
OPENID_REQUIRED_ROLE_TOKEN_KIND=id
|
||||||
|
OPENID_REQUIRED_ROLE_PARAMETER_PATH="roles"
|
||||||
|
OPENID_REQUIRED_ROLE="Your Group Name"
|
||||||
|
```
|
||||||
|
11. Save the .env file
|
||||||
|
|
||||||
|
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||||
|
|
||||||
49
docs/install/configuration/OAuth2-and-OIDC/discord.md
Normal file
49
docs/install/configuration/OAuth2-and-OIDC/discord.md
Normal file
|
|
@ -0,0 +1,49 @@
|
||||||
|
---
|
||||||
|
title: Discord
|
||||||
|
description: Learn how to configure LibreChat to use Discord for user authentication.
|
||||||
|
weight: -11
|
||||||
|
---
|
||||||
|
|
||||||
|
# Discord
|
||||||
|
|
||||||
|
## Create a new Discord Application
|
||||||
|
|
||||||
|
- Go to **[Discord Developer Portal](https://discord.com/developers)**
|
||||||
|
|
||||||
|
- Create a new Application and give it a name
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Discord Application Configuration
|
||||||
|
|
||||||
|
- In the OAuth2 general settings add a valid redirect URL:
|
||||||
|
- Example for localhost: `http://localhost:3080/oauth/discord/callback`
|
||||||
|
- Example for a domain: `https://example.com/oauth/discord/callback`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- In `Default Authorization Link`, select `In-app Authorization` and set the scopes to `applications.commands`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Save changes and reset the Client Secret
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## .env Configuration
|
||||||
|
|
||||||
|
- Paste your `Client ID` and `Client Secret` in the `.env` file:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
|
||||||
|
DISCORD_CLIENT_ID=your_client_id
|
||||||
|
DISCORD_CLIENT_SECRET=your_client_secret
|
||||||
|
DISCORD_CALLBACK_URL=/oauth/discord/callback
|
||||||
|
```
|
||||||
|
|
||||||
|
- Save the `.env` file
|
||||||
|
|
||||||
|
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||||
83
docs/install/configuration/OAuth2-and-OIDC/facebook.md
Normal file
83
docs/install/configuration/OAuth2-and-OIDC/facebook.md
Normal file
|
|
@ -0,0 +1,83 @@
|
||||||
|
---
|
||||||
|
title: Facebook
|
||||||
|
description: Learn how to configure LibreChat to use Facebook for user authentication.
|
||||||
|
weight: -8
|
||||||
|
---
|
||||||
|
|
||||||
|
# Facebook - WIP
|
||||||
|
|
||||||
|
> ⚠️ **Warning: Work in progress, not currently functional**
|
||||||
|
|
||||||
|
> ❗ Note: Facebook Authentication will not work from `localhost`
|
||||||
|
|
||||||
|
## Create a Facebook Application
|
||||||
|
|
||||||
|
- Go to the **[Facebook Developer Portal](https://developers.facebook.com/)**
|
||||||
|
|
||||||
|
- Click on "My Apps" in the header menu
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Create a new application
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Select "Authenticate and request data from users with Facebook Login"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Choose "No, I'm not creating a game"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Provide an `app name` and `App contact email` and click `Create app`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Facebook Application Configuration
|
||||||
|
|
||||||
|
- In the side menu, select "Use cases" and click "Customize" under "Authentication and account creation."
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Add the `email permission`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Now click `Go to settings`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Ensure that `Client OAuth login`, `Web OAuth login` and `Enforce HTTPS` are **enabled**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Add a `Valid OAuth Redirect URIs` and "Save changes"
|
||||||
|
- Example for a domain: `https://example.com/oauth/facebook/callback`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Click `Go back` and select `Basic` in the `App settings` tab
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Click "Show" next to the App secret.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## .env Configuration
|
||||||
|
|
||||||
|
- Copy the `App ID` and `App Secret` and paste them into the `.env` file as follows:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
|
||||||
|
FACEBOOK_CLIENT_ID=your_app_id
|
||||||
|
FACEBOOK_CLIENT_SECRET=your_app_secret
|
||||||
|
FACEBOOK_CALLBACK_URL=/oauth/facebook/callback
|
||||||
|
```
|
||||||
|
|
||||||
|
- Save the `.env` file.
|
||||||
|
|
||||||
|
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||||
65
docs/install/configuration/OAuth2-and-OIDC/github.md
Normal file
65
docs/install/configuration/OAuth2-and-OIDC/github.md
Normal file
|
|
@ -0,0 +1,65 @@
|
||||||
|
---
|
||||||
|
title: GitHub
|
||||||
|
description: Learn how to configure LibreChat to use GitHub for user authentication.
|
||||||
|
weight: -10
|
||||||
|
---
|
||||||
|
|
||||||
|
# GitHub
|
||||||
|
|
||||||
|
## Create a GitHub Application
|
||||||
|
|
||||||
|
- Go to your **[Github Developer settings](https://github.com/settings/apps)**
|
||||||
|
- Create a new Github app
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## GitHub Application Configuration
|
||||||
|
|
||||||
|
- Give it a `GitHub App name` and set your `Homepage URL`
|
||||||
|
- Example for localhost: `http://localhost:3080`
|
||||||
|
- Example for a domain: `https://example.com`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Add a valid `Callback URL`:
|
||||||
|
- Example for localhost: `http://localhost:3080/oauth/github/callback`
|
||||||
|
- Example for a domain: `https://example.com/oauth/github/callback`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Uncheck the box labeled `Active` in the `Webhook` section
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Scroll down to `Account permissions` and set `Email addresses` to `Access: Read-only`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Click on `Create GitHub App`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## .env Configuration
|
||||||
|
|
||||||
|
- Click `Generate a new client secret`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Copy the `Client ID` and `Client Secret` in the `.env` file
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
```bash
|
||||||
|
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
|
||||||
|
GITHUB_CLIENT_ID=your_client_id
|
||||||
|
GITHUB_CLIENT_SECRET=your_client_secret
|
||||||
|
GITHUB_CALLBACK_URL=/oauth/github/callback
|
||||||
|
```
|
||||||
|
|
||||||
|
- Save the `.env` file
|
||||||
|
|
||||||
|
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||||
97
docs/install/configuration/OAuth2-and-OIDC/google.md
Normal file
97
docs/install/configuration/OAuth2-and-OIDC/google.md
Normal file
|
|
@ -0,0 +1,97 @@
|
||||||
|
---
|
||||||
|
title: Google
|
||||||
|
description: Learn how to configure LibreChat to use Google for user authentication.
|
||||||
|
weight: -9
|
||||||
|
---
|
||||||
|
|
||||||
|
# Google
|
||||||
|
|
||||||
|
## Create a Google Application
|
||||||
|
|
||||||
|
- Visit: **[Google Cloud Console](https://cloud.google.com)** and open the `Console`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Create a New Project and give it a name
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Google Application Configuration
|
||||||
|
|
||||||
|
- Select the project you just created and go to `APIs and Services`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Select `Credentials` and click `CONFIGURE CONSENT SCREEN`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Select `External` then click `CREATE`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Fill in your App information
|
||||||
|
|
||||||
|
> Note: You can get a logo from your LibreChat folder here: `docs\assets\favicon_package\android-chrome-192x192.png`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Configure your `App domain` and add your `Developer contact information` then click `SAVE AND CONTINUE`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Configure the `Sopes`
|
||||||
|
- Add `email`,`profile` and `openid`
|
||||||
|
- Click `UPDATE` and `SAVE AND CONTINUE`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Click `SAVE AND CONTINUE`
|
||||||
|
- Review your app and go back to dashboard
|
||||||
|
|
||||||
|
- Go back to the `Credentials` tab, click on `+ CREATE CREDENTIALS` and select `OAuth client ID`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Select `Web application` and give it a name
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Configure the `Authorized JavaScript origins`, you can add both your domain and localhost if you desire
|
||||||
|
- Example for localhost: `http://localhost:3080`
|
||||||
|
- Example for a domain: `https://example.com`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Add a valid `Authorized redirect URIs`
|
||||||
|
- Example for localhost: `http://localhost:3080/oauth/google/callback`
|
||||||
|
- Example for a domain: `https://example.com/oauth/google/callback`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## .env Configuration
|
||||||
|
|
||||||
|
- Click `CREATE` and copy your `Client ID` and `Client secret`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
- Add them to your `.env` file:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
DOMAIN_CLIENT=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
DOMAIN_SERVER=https://your-domain.com # use http://localhost:3080 if not using a custom domain
|
||||||
|
|
||||||
|
GOOGLE_CLIENT_ID=your_client_id
|
||||||
|
GOOGLE_CLIENT_SECRET=your_client_secret
|
||||||
|
GOOGLE_CALLBACK_URL=/oauth/github/callback
|
||||||
|
```
|
||||||
|
|
||||||
|
- Save the `.env` file
|
||||||
|
|
||||||
|
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
||||||
68
docs/install/configuration/OAuth2-and-OIDC/keycloak.md
Normal file
68
docs/install/configuration/OAuth2-and-OIDC/keycloak.md
Normal file
|
|
@ -0,0 +1,68 @@
|
||||||
|
---
|
||||||
|
title: Keycloak
|
||||||
|
description: Learn how to configure LibreChat to use Keycloak for user authentication.
|
||||||
|
weight: -5
|
||||||
|
---
|
||||||
|
|
||||||
|
# Keycloak
|
||||||
|
|
||||||
|
1. **Access Keycloak Admin Console:**
|
||||||
|
- Open the Keycloak Admin Console in your web browser. This is usually
|
||||||
|
found at a URL like `http://localhost:8080/auth/admin/`.
|
||||||
|
|
||||||
|
2. **Create a Realm (if necessary):**
|
||||||
|
- If you don't already have a realm for your application, create one. Click on 'Add Realm' and give it a name.
|
||||||
|
|
||||||
|
3. **Create a Client:**
|
||||||
|
- Within your realm, click on 'Clients' and then 'Create'.
|
||||||
|
- Enter a client ID and select 'openid-connect' as the Client Protocol.
|
||||||
|
- Set 'Client Authentication' to 'On'.
|
||||||
|
- In 'Valid Redirect URIs', enter `http://localhost:3080/oauth/openid/callback` or the appropriate URI for
|
||||||
|
your application.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
4. **Configure Client:**
|
||||||
|
- After creating the client, you will be redirected to its settings page.
|
||||||
|
- Note the 'Client ID' and 'Secret' from the 'Credentials' tab – you'll need these for your application.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
5. **Add Roles (Optional):**
|
||||||
|
If you want to restrict access to users with specific roles, you can define roles in Keycloak and assign them to users.
|
||||||
|
- Go to the 'Roles' tab in your client or realm (depending on where you want to define the roles).
|
||||||
|
- Create a new role that matches the value you have in `OPENID_REQUIRED_ROLE`.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
6. **Assign Roles to Users (Optional):**
|
||||||
|
- Go to 'Users', select a user, and go to the 'Role Mappings' tab.
|
||||||
|
- Assign the appropriate role (that matches `OPENID_REQUIRED_ROLE`) to the user.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
7. **Get path of roles list inside token (Optional):**
|
||||||
|
- Decode your jwtToken from OpenID provider and determine path for roles list inside access token. For example, if you are
|
||||||
|
using Keycloak, the path is `realm_access.roles`.
|
||||||
|
- Put this path in `OPENID_REQUIRED_ROLE_PARAMETER_PATH` variable in `.env` file.
|
||||||
|
- By parameter `OPENID_REQUIRED_ROLE_TOKEN_KIND` you can specify which token kind you want to use.
|
||||||
|
Possible values are `access` and `id`.
|
||||||
|
|
||||||
|
8**Update Your Project's Configuration:**
|
||||||
|
- Open the `.env` file in your project folder and add the following variables:
|
||||||
|
```
|
||||||
|
OPENID_ISSUER=http://localhost:8080/auth/realms/[YourRealmName]
|
||||||
|
OPENID_CLIENT_ID=[YourClientID]
|
||||||
|
OPENID_CLIENT_SECRET=[YourClientSecret]
|
||||||
|
OPENID_CALLBACK_URL=http://localhost:3080/oauth/openid/callback
|
||||||
|
OPENID_SCOPE="openid profile email"
|
||||||
|
OPENID_REQUIRED_ROLE=[YourRequiredRole]
|
||||||
|
OPENID_REQUIRED_ROLE_TOKEN_KIND=(access|id)
|
||||||
|
OPENID_REQUIRED_ROLE_PARAMETER_PATH="realm_access.roles"
|
||||||
|
```
|
||||||
|
|
@ -16,7 +16,7 @@ Alternatively, you can create a new file named `docker-compose.override.yml` in
|
||||||
For more info see:
|
For more info see:
|
||||||
|
|
||||||
- Our quick guide:
|
- Our quick guide:
|
||||||
- **[Docker Override](../configuration/docker_override.md)**
|
- **[Docker Override](./docker_override.md)**
|
||||||
|
|
||||||
- The official docker documentation:
|
- The official docker documentation:
|
||||||
- **[docker docs - understanding-multiple-compose-files](https://docs.docker.com/compose/multiple-compose-files/extends/#understanding-multiple-compose-files)**
|
- **[docker docs - understanding-multiple-compose-files](https://docs.docker.com/compose/multiple-compose-files/extends/#understanding-multiple-compose-files)**
|
||||||
|
|
@ -274,7 +274,7 @@ DALLE2_API_KEY=your-azure-api-key-for-dall-e-2
|
||||||
### BingAI
|
### BingAI
|
||||||
Bing, also used for Sydney, jailbreak, and Bing Image Creator, see: [Bing Access token](./ai_setup.md#bingai) and [Bing Jailbreak](../../features/bing_jailbreak.md)
|
Bing, also used for Sydney, jailbreak, and Bing Image Creator, see: [Bing Access token](./ai_setup.md#bingai) and [Bing Jailbreak](../../features/bing_jailbreak.md)
|
||||||
|
|
||||||
- Follow these instructions to get your bing access token (it's best to use the full cookie string for that purpose): **[Bing Access Token](../configuration/ai_setup.md#bingai)**
|
- Follow these instructions to get your bing access token (it's best to use the full cookie string for that purpose): **[Bing Access Token](./ai_setup.md#bingai)**
|
||||||
- Leave `BINGAI_TOKEN=` blank to disable this endpoint
|
- Leave `BINGAI_TOKEN=` blank to disable this endpoint
|
||||||
- Set `BINGAI_TOKEN=` to "user_provided" to allow users to provide their own API key from the WebUI
|
- Set `BINGAI_TOKEN=` to "user_provided" to allow users to provide their own API key from the WebUI
|
||||||
|
|
||||||
|
|
@ -719,7 +719,7 @@ CHECK_BALANCE=false
|
||||||
```
|
```
|
||||||
|
|
||||||
### Registration and Login
|
### Registration and Login
|
||||||
see: **[User/Auth System](../configuration/user_auth_system.md)**
|
see: **[User/Auth System](./user_auth_system.md)**
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -757,9 +757,9 @@ JWT_REFRESH_SECRET=eaa5191f2914e30b9387fd84e254e4ba6fc51b4654968a9b0803b456a54b8
|
||||||
|
|
||||||
### Social Logins
|
### Social Logins
|
||||||
|
|
||||||
#### [Discord Authentication](../configuration/user_auth_system.md#discord)
|
#### [Discord Authentication](./OAuth2-and-OIDC/discord.md)
|
||||||
|
|
||||||
for more information: **[Discord](../configuration/user_auth_system.md#discord)**
|
for more information: **[Discord](./OAuth2-and-OIDC/discord.md)**
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# Discord
|
# Discord
|
||||||
|
|
@ -768,9 +768,9 @@ DISCORD_CLIENT_SECRET=your_client_secret
|
||||||
DISCORD_CALLBACK_URL=/oauth/discord/callback
|
DISCORD_CALLBACK_URL=/oauth/discord/callback
|
||||||
```
|
```
|
||||||
|
|
||||||
#### [Facebook Authentication](../configuration/user_auth_system.md#facebook)
|
#### [Facebook Authentication](./OAuth2-and-OIDC/facebook.md)
|
||||||
|
|
||||||
for more information: **[Facebook Authentication](../configuration/user_auth_system.md#facebook)**
|
for more information: **[Facebook Authentication](./OAuth2-and-OIDC/facebook.md)**
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# Facebook
|
# Facebook
|
||||||
|
|
@ -779,9 +779,9 @@ FACEBOOK_CLIENT_SECRET=
|
||||||
FACEBOOK_CALLBACK_URL=/oauth/facebook/callback
|
FACEBOOK_CALLBACK_URL=/oauth/facebook/callback
|
||||||
|
|
||||||
```
|
```
|
||||||
#### [GitHub Authentication](../configuration/user_auth_system.md#github)
|
#### [GitHub Authentication](./OAuth2-and-OIDC/github.md)
|
||||||
|
|
||||||
for more information: **[GitHub Authentication](../configuration/user_auth_system.md#github)**
|
for more information: **[GitHub Authentication](./OAuth2-and-OIDC/github.md)**
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# GitHub
|
# GitHub
|
||||||
|
|
@ -790,9 +790,9 @@ GITHUB_CLIENT_SECRET=your_client_secret
|
||||||
GITHUB_CALLBACK_URL=/oauth/github/callback
|
GITHUB_CALLBACK_URL=/oauth/github/callback
|
||||||
```
|
```
|
||||||
|
|
||||||
#### [Google Authentication](../configuration/user_auth_system.md#google)
|
#### [Google Authentication](./OAuth2-and-OIDC/google.md)
|
||||||
|
|
||||||
for more information: **[Google Authentication](../configuration/user_auth_system.md#google)**
|
for more information: **[Google Authentication](./OAuth2-and-OIDC/google.md)**
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# Google
|
# Google
|
||||||
|
|
@ -801,9 +801,9 @@ GOOGLE_CLIENT_SECRET=
|
||||||
GOOGLE_CALLBACK_URL=/oauth/google/callback
|
GOOGLE_CALLBACK_URL=/oauth/google/callback
|
||||||
```
|
```
|
||||||
|
|
||||||
#### [OpenID Authentication](../configuration/user_auth_system.md#openid-with-aws-cognito)
|
#### [OpenID Authentication](./OAuth2-and-OIDC/aws.md)
|
||||||
|
|
||||||
for more information: **[Azure OpenID Authentication](../configuration/user_auth_system.md#openid-with-azure-ad)** or **[AWS Cognito OpenID Authentication](../configuration/user_auth_system.md#openid-with-aws-cognito)**
|
for more information: **[Azure OpenID Authentication](./OAuth2-and-OIDC/azure.md)** or **[AWS Cognito OpenID Authentication](./OAuth2-and-OIDC/aws.md)**
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# OpenID
|
# OpenID
|
||||||
|
|
@ -813,13 +813,15 @@ OPENID_ISSUER=
|
||||||
OPENID_SESSION_SECRET=
|
OPENID_SESSION_SECRET=
|
||||||
OPENID_SCOPE="openid profile email"
|
OPENID_SCOPE="openid profile email"
|
||||||
OPENID_CALLBACK_URL=/oauth/openid/callback
|
OPENID_CALLBACK_URL=/oauth/openid/callback
|
||||||
|
|
||||||
OPENID_BUTTON_LABEL=
|
OPENID_BUTTON_LABEL=
|
||||||
OPENID_IMAGE_URL=
|
OPENID_IMAGE_URL=
|
||||||
|
OPENID_REQUIRED_ROLE_TOKEN_KIND=
|
||||||
|
OPENID_REQUIRED_ROLE=
|
||||||
|
OPENID_REQUIRED_ROLE_PARAMETER_PATH=
|
||||||
```
|
```
|
||||||
|
|
||||||
### Email Password Reset
|
### Email Password Reset
|
||||||
Email is used for password reset. See: **[Email Password Reset](../configuration/user_auth_system.md#email-and-password-reset)**
|
Email is used for password reset. See: **[Email Password Reset](./user_auth_system.md#email-and-password-reset)**
|
||||||
|
|
||||||
- Note that all either service or host, username and password and the From address must be set for email to work.
|
- Note that all either service or host, username and password and the From address must be set for email to work.
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -166,431 +166,16 @@ EMAIL_FROM_NAME="My LibreChat Server"
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Social Authentication - Setup and Configuration
|
## Social Authentication
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Discord
|
### OAuth2
|
||||||
|
- [Discord](./OAuth2-and-OIDC/discord.md)
|
||||||
#### Create a new Discord Application
|
- [GitHub](./OAuth2-and-OIDC/github.md)
|
||||||
|
- [Google](./OAuth2-and-OIDC/google.md)
|
||||||
- Go to **[Discord Developer Portal](https://discord.com/developers)**
|
- [Facebook](./OAuth2-and-OIDC/facebook.md)
|
||||||
|
### OpenID Connect
|
||||||
- Create a new Application and give it a name
|
- [AWS Cognito](./OAuth2-and-OIDC/aws.md)
|
||||||
|
- [Azure Entra/AD](./OAuth2-and-OIDC/azure.md)
|
||||||
|
- [Keycloak](./OAuth2-and-OIDC/keycloak.md)
|
||||||
|
|
||||||
#### Discord Application Configuration
|
|
||||||
|
|
||||||
- In the OAuth2 general settings add a valid redirect URL:
|
|
||||||
- Example for localhost: `http://localhost:3080/oauth/discord/callback`
|
|
||||||
- Example for a domain: `https://example.com/oauth/discord/callback`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- In `Default Authorization Link`, select `In-app Authorization` and set the scopes to `applications.commands`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Save changes and reset the Client Secret
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### .env Configuration
|
|
||||||
|
|
||||||
- Paste your `Client ID` and `Client Secret` in the `.env` file:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
|
|
||||||
DISCORD_CLIENT_ID=your_client_id
|
|
||||||
DISCORD_CLIENT_SECRET=your_client_secret
|
|
||||||
DISCORD_CALLBACK_URL=/oauth/discord/callback
|
|
||||||
```
|
|
||||||
|
|
||||||
- Save the `.env` file
|
|
||||||
|
|
||||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### Facebook - WIP
|
|
||||||
|
|
||||||
> ⚠️ **Warning: Work in progress, not currently functional**
|
|
||||||
|
|
||||||
> ❗ Note: Facebook Authentication will not work from `localhost`
|
|
||||||
|
|
||||||
#### Create a Facebook Application
|
|
||||||
|
|
||||||
- Go to the **[Facebook Developer Portal](https://developers.facebook.com/)**
|
|
||||||
|
|
||||||
- Click on "My Apps" in the header menu
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Create a new application
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Select "Authenticate and request data from users with Facebook Login"
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Choose "No, I'm not creating a game"
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Provide an `app name` and `App contact email` and click `Create app`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Facebook Application Configuration
|
|
||||||
|
|
||||||
- In the side menu, select "Use cases" and click "Customize" under "Authentication and account creation."
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Add the `email permission`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Now click `Go to settings`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Ensure that `Client OAuth login`, `Web OAuth login` and `Enforce HTTPS` are **enabled**.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Add a `Valid OAuth Redirect URIs` and "Save changes"
|
|
||||||
- Example for a domain: `https://example.com/oauth/facebook/callback`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Click `Go back` and select `Basic` in the `App settings` tab
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Click "Show" next to the App secret.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### .env Configuration
|
|
||||||
|
|
||||||
- Copy the `App ID` and `App Secret` and paste them into the `.env` file as follows:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
|
|
||||||
FACEBOOK_CLIENT_ID=your_app_id
|
|
||||||
FACEBOOK_CLIENT_SECRET=your_app_secret
|
|
||||||
FACEBOOK_CALLBACK_URL=/oauth/facebook/callback
|
|
||||||
```
|
|
||||||
|
|
||||||
- Save the `.env` file.
|
|
||||||
|
|
||||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### GitHub
|
|
||||||
|
|
||||||
#### Create a GitHub Application
|
|
||||||
|
|
||||||
- Go to your **[Github Developer settings](https://github.com/settings/apps)**
|
|
||||||
- Create a new Github app
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### GitHub Application Configuration
|
|
||||||
|
|
||||||
- Give it a `GitHub App name` and set your `Homepage URL`
|
|
||||||
- Example for localhost: `http://localhost:3080`
|
|
||||||
- Example for a domain: `https://example.com`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Add a valid `Callback URL`:
|
|
||||||
- Example for localhost: `http://localhost:3080/oauth/github/callback`
|
|
||||||
- Example for a domain: `https://example.com/oauth/github/callback`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Uncheck the box labeled `Active` in the `Webhook` section
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Scroll down to `Account permissions` and set `Email addresses` to `Access: Read-only`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Click on `Create GitHub App`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### .env Configuration
|
|
||||||
|
|
||||||
- Click `Generate a new client secret`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Copy the `Client ID` and `Client Secret` in the `.env` file
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
```bash
|
|
||||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
|
|
||||||
GITHUB_CLIENT_ID=your_client_id
|
|
||||||
GITHUB_CLIENT_SECRET=your_client_secret
|
|
||||||
GITHUB_CALLBACK_URL=/oauth/github/callback
|
|
||||||
```
|
|
||||||
|
|
||||||
- Save the `.env` file
|
|
||||||
|
|
||||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### Google
|
|
||||||
|
|
||||||
#### Create a Google Application
|
|
||||||
|
|
||||||
- Visit: **[Google Cloud Console](https://cloud.google.com)** and open the `Console`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Create a New Project and give it a name
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Google Application Configuration
|
|
||||||
|
|
||||||
- Select the project you just created and go to `APIs and Services`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Select `Credentials` and click `CONFIGURE CONSENT SCREEN`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Select `External` then click `CREATE`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Fill in your App information
|
|
||||||
|
|
||||||
> Note: You can get a logo from your LibreChat folder here: `docs\assets\favicon_package\android-chrome-192x192.png`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Configure your `App domain` and add your `Developer contact information` then click `SAVE AND CONTINUE`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Configure the `Sopes`
|
|
||||||
- Add `email`,`profile` and `openid`
|
|
||||||
- Click `UPDATE` and `SAVE AND CONTINUE`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Click `SAVE AND CONTINUE`
|
|
||||||
- Review your app and go back to dashboard
|
|
||||||
|
|
||||||
- Go back to the `Credentials` tab, click on `+ CREATE CREDENTIALS` and select `OAuth client ID`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Select `Web application` and give it a name
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Configure the `Authorized JavaScript origins`, you can add both your domain and localhost if you desire
|
|
||||||
- Example for localhost: `http://localhost:3080`
|
|
||||||
- Example for a domain: `https://example.com`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Add a valid `Authorized redirect URIs`
|
|
||||||
- Example for localhost: `http://localhost:3080/oauth/google/callback`
|
|
||||||
- Example for a domain: `https://example.com/oauth/google/callback`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### .env Configuration
|
|
||||||
|
|
||||||
- Click `CREATE` and copy your `Client ID` and `Client secret`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Add them to your `.env` file:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
|
|
||||||
GOOGLE_CLIENT_ID=your_client_id
|
|
||||||
GOOGLE_CLIENT_SECRET=your_client_secret
|
|
||||||
GOOGLE_CALLBACK_URL=/oauth/github/callback
|
|
||||||
```
|
|
||||||
|
|
||||||
- Save the `.env` file
|
|
||||||
|
|
||||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### OpenID with AWS Cognito
|
|
||||||
|
|
||||||
#### Create a new User Pool in Cognito
|
|
||||||
|
|
||||||
- Visit: **[https://console.aws.amazon.com/cognito/](https://console.aws.amazon.com/cognito/)**
|
|
||||||
- Sign in as Root User
|
|
||||||
- Click on `Create user pool`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Configure sign-in experience
|
|
||||||
|
|
||||||
Your Cognito user pool sign-in options should include `User Name` and `Email`.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Configure Security Requirements
|
|
||||||
|
|
||||||
You can configure the password requirements now if you desire
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Configure sign-up experience
|
|
||||||
|
|
||||||
Choose the attributes required at signup. The minimum required is `name`. If you want to require users to use their full name at sign up use: `given_name` and `family_name` as required attributes.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Configure message delivery
|
|
||||||
|
|
||||||
Send email with Cognito can be used for free for up to 50 emails a day
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Integrate your app
|
|
||||||
|
|
||||||
Select `Use Cognitio Hosted UI` and chose a domain name
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Set the app type to `Confidential client`
|
|
||||||
Make sure `Generate a client secret` is set.
|
|
||||||
Set the `Allowed callback URLs` to `https://YOUR_DOMAIN/oauth/openid/callback`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Under `Advanced app client settings` make sure `Profile` is included in the `OpenID Connect scopes` (in the bottom)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Review and create
|
|
||||||
You can now make last minute changes, click on `Create user pool` when you're done reviewing the configuration
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#### Get your environment variables
|
|
||||||
|
|
||||||
1. Open your User Pool
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
2. The `User Pool ID` and your AWS region will be used to construct the `OPENID_ISSUER` (see below)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
3. Go to the `App Integrations` tab
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
4. Open the app client
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
5. Toggle `Show Client Secret`
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Use the `Client ID` for `OPENID_CLIENT_ID`
|
|
||||||
|
|
||||||
- Use the `Client secret` for `OPENID_CLIENT_SECRET`
|
|
||||||
|
|
||||||
- Generate a random string for the `OPENID_SESSION_SECRET`
|
|
||||||
|
|
||||||
> The `OPENID_SCOPE` and `OPENID_CALLBACK_URL` are pre-configured with the correct values
|
|
||||||
|
|
||||||
6. Open the `.env` file at the root of your LibreChat folder and add the following variables with the values you copied:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
|
|
||||||
OPENID_CLIENT_ID=Your client ID
|
|
||||||
OPENID_CLIENT_SECRET=Your client secret
|
|
||||||
OPENID_ISSUER=https://cognito-idp.[AWS REGION].amazonaws.com/[USER POOL ID]/.well-known/openid-configuration
|
|
||||||
OPENID_SESSION_SECRET=Any random string
|
|
||||||
OPENID_SCOPE=openid profile email
|
|
||||||
OPENID_CALLBACK_URL=/oauth/openid/callback
|
|
||||||
```
|
|
||||||
7. Save the .env file
|
|
||||||
|
|
||||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
|
||||||
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### OpenID with Azure AD
|
|
||||||
|
|
||||||
1. Go to the [Azure Portal](https://portal.azure.com/) and sign in with your account.
|
|
||||||
2. In the search box, type "Azure Active Directory" and click on it.
|
|
||||||
3. On the left menu, click on App registrations and then on New registration.
|
|
||||||
4. Give your app a name and select Web as the platform type.
|
|
||||||
5. In the Redirect URI field, enter `http://localhost:3080/oauth/openid/callback` and click on Register.
|
|
||||||
6. You will see an Overview page with some information about your app. Copy the Application (client) ID and the Directory (tenant) ID and save them somewhere.
|
|
||||||
7. On the left menu, click on Authentication and check the boxes for Access tokens and ID tokens under Implicit grant and hybrid flows.
|
|
||||||
8. On the left menu, click on Certificates & Secrets and then on New client secret. Give your secret a name and an expiration date and click on Add.
|
|
||||||
9. You will see a Value column with your secret. Copy it and save it somewhere. Don't share it with anyone!
|
|
||||||
10. Open the .env file in your project folder and add the following variables with the values you copied:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
DOMAIN_CLIENT=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
DOMAIN_SERVER=https://your-domain.com #use http://localhost:3080 if not using a custom domain
|
|
||||||
|
|
||||||
OPENID_CLIENT_ID=Your Application (client) ID
|
|
||||||
OPENID_CLIENT_SECRET=Your client secret
|
|
||||||
OPENID_ISSUER=https://login.microsoftonline.com/Your Directory (tenant ID)/v2.0/
|
|
||||||
OPENID_SESSION_SECRET=Any random string
|
|
||||||
OPENID_SCOPE=openid profile email #DO NOT CHANGE THIS
|
|
||||||
OPENID_CALLBACK_URL=/oauth/openid/callback # this should be the same for everyone
|
|
||||||
```
|
|
||||||
11. Save the .env file
|
|
||||||
|
|
||||||
> Note: If using docker, run `docker compose up -d` to apply the .env configuration changes
|
|
||||||
|
|
||||||
|
|
||||||
---
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue