Can't enable OIDC

Describe the bug
Trying to enable OIDC I fill out the settings in the webui but when I try to save I get Error: OIDC is enabled but providerUrl, redirectUri, and clientId are required.. Those are all filled, even tried filling the OIDC info, saving THEN unchecking disable OIDC and still no go.

To Reproduce
Steps to reproduce the behavior:

Go to Admin Panel
Fill out OIDC info and uncheck Disable OIDC Login
Click Save Settings
See error

Expected behavior
I expected to enable OIDC as a login option.

Desktop (please complete the following information):

OS: Ubuntu (Docker)
Browser Vivaldi
Version 7.6.3797.63

Additional context
Fresh install, first thing I did after getting the container up.

@Diagonet

Thank you @Diagonet for opening this. A recent update caused this issue for first save you needed to replace but wasn't visible. This is now resolved in v1.8.9.

Thanks for the quick fix, Im trying to get it working OIDC with authelia's guide but

{"time":"2025-11-08T03:46:24Z","level":"error","msg":"Authorization Response for Request with id '30856c3a-7a81-4583-8be3-bea86470ed6f' on client with id 'filerise' using policy 'admin_only' could not be created: The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Clients must include a 'code_challenge' when performing the authorize code flow, but it is missing. The authorization server is configured in a way that enforces PKCE for all public client type clients and the 'filerise' client is using the public client type.","method":"GET","path":"/api/oidc/authorization","remote_ip":"redacted"}

I get this error. Also, this client doesn't use secrets? Normally I have to add the hash to authelia's config but here its saying to enable 'public' which doesnt allow that.

Register the client as non-public and give it a secret.

Generate the secret + hash with Authelia’s CLI and put the plaintext secret in FileRise Admin (OIDC Client Secret), put the hash in Authelia’s config.

Will try that but then it asks for a token_endpoint_auth_method: would you know if its client_secret_basic or client_secret_post? I guess I can probably just test it, will try tomorrow.

FileRise uses the Jumbojett PHP OIDC client, which defaults to client_secret_basic for token endpoint auth. If you want to use client_secret_post, Authelia supports it, and FileRise/Jumbojett can use it too.

release(v1.8.9): fix(oidc, admin): first-save Client ID/Secret (closes …

Yeah, couldn't get OIDC working with Authelia no matter what I changed, keep getting the same error about 'code_challenge'

@Diagonet

@Diagonet

I’ve updated FileRise v1.8.11 to always send PKCE (S256) during the OIDC authorize request. That should satisfy Authelia’s requirement for public clients and also works fine with confidential clients.

If you’re still seeing the “code_challenge” error, double-check:
• Your Authelia client is either public: true + require_pkce: true or public: false with a secret.
• The redirect URI in Authelia exactly matches what you set in FileRise Admin (no extra slashes or params).
After reloading Authelia, try again and you should now see code_challenge and code_challenge_method=S256 on the /authorize URL.

@Diagonet

@Diagonet I reopened this. Could you confirm if v1.8.11 resolves your issue?

It seems to be fixed yeah, thanks. I don't really know how to but if you wanna submit a PR to Authelia's guide https://www.authelia.com/integration/openid-connect/clients/file-rise/
Here is what worked for me, for Authelia's config

      - client_id: 'filerise'
        client_name: 'FileRise'
        client_secret: "secret_digest"
        public: false
        authorization_policy: 'two_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://rise.example.com/api/auth/auth.php?oidc=callback'
        scopes:
          - 'openid'
          - 'email'
          - 'profile'
        response_modes:
          - 'form_post'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'

@Diagonet

Thanks for the help with this @Diagonet

One more thing though haha
I tried disabling the regular login, Disable all built-in logins (proxy only) doesn't seem to stop login with my local account and Disable Login Form just removes the ability to login. Is there a way to disable local login and maybe enable auto login through OIDC?

@Diagonet

Hey @Diagonet

This wasn't working as expected/previously. This now fixed in v1.8.12; When both basic auth and login form are disabled and only OIDC is enabled it will auto login through OIDC.

Thanks again for your help on this. I recently made changes to main.js and this was missed.

will check it out soon, thanks

It does only show the OIDC login option but if I may suggest, would be even better if it auto redirected to the OIDC login instead of requiring clicking the button, that is usually how other apps do it.

I did add auto redirect which it is working for me.

You have to have basic auth and login form disabled.

Oh weird, first time I accessed it I had time to click the button, now I tried again and it redirected, nvm then. Thanks again!

Navigation Menu

Repository navigation

Can't enable OIDC #64

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Can't enable OIDC #64

Description

Activity

error311 commented on Nov 8, 2025

Diagonet commented on Nov 8, 2025

error311 commented on Nov 8, 2025

Diagonet commented on Nov 8, 2025

error311 commented on Nov 8, 2025

Diagonet commented on Nov 8, 2025

error311 commented on Nov 8, 2025

error311 commented on Nov 8, 2025

Diagonet commented on Nov 8, 2025

error311 commented on Nov 8, 2025

Diagonet commented on Nov 8, 2025

error311 commented on Nov 8, 2025

Diagonet commented on Nov 8, 2025

Diagonet commented on Nov 8, 2025

error311 commented on Nov 8, 2025

Diagonet commented on Nov 8, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions