Document OIDC Token Endpoint Authentication Method about freshrss HOT 3 OPEN

Hello,
Check the following guides. Does that help ?

• https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect.html
• https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect-Authentik.html
• https://goauthentik.io/integrations/services/freshrss/

Here is how we use mod_auth_openidc:

from freshrss.

Hello, Check the following guides. Does that help ?

* https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect.html

* https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect-Authentik.html

* https://goauthentik.io/integrations/services/freshrss/

Here is how we use mod_auth_openidc:

FreshRSS/Docker/FreshRSS.Apache.conf

Lines 20 to 57 in 2989470

	<IfDefine OIDC_ENABLED>
	<IfModule !auth_openidc_module>
	Error "The auth_openidc_module is not available. Install it or unset environment variable OIDC_ENABLED."
	</IfModule>
	# Workaround to be able to check whether an environment variable is set
	# See: https://serverfault.com/questions/1022233/using-ifdefine-with-environment-variables/1022234#1022234
	Define VStart "${"
	Define VEnd "}"
	OIDCProviderMetadataURL ${OIDC_PROVIDER_METADATA_URL}
	OIDCClientID ${OIDC_CLIENT_ID}
	OIDCClientSecret ${OIDC_CLIENT_SECRET}
	OIDCRedirectURI /i/oidc/
	OIDCCryptoPassphrase ${OIDC_CLIENT_CRYPTO_KEY}
	Define "Test_${OIDC_REMOTE_USER_CLAIM}"
	<IfDefine Test_${VStart}OIDC_REMOTE_USER_CLAIM${VEnd}>
	OIDCRemoteUserClaim preferred_username
	</IfDefine>
	<IfDefine !Test_${VStart}OIDC_REMOTE_USER_CLAIM${VEnd}>
	OIDCRemoteUserClaim "${OIDC_REMOTE_USER_CLAIM}"
	</IfDefine>
	Define "Test_${OIDC_SCOPES}"
	<IfDefine Test_${VStart}OIDC_SCOPES${VEnd}>
	OIDCScope openid
	</IfDefine>
	<IfDefine !Test_${VStart}OIDC_SCOPES${VEnd}>
	OIDCScope "${OIDC_SCOPES}"
	</IfDefine>
	Define "Test_${OIDC_X_FORWARDED_HEADERS}"
	<IfDefine !Test_${VStart}OIDC_X_FORWARDED_HEADERS${VEnd}>
	OIDCXForwardedHeaders ${OIDC_X_FORWARDED_HEADERS}
	</IfDefine>
	OIDCRefreshAccessTokenBeforeExpiry 30
	</IfDefine>

No sorry, that doesn't show the auth method.

To work backwards, it's not any of the JWT types because you don't need a jwt seed. So is it must be client_secret_basic or client_secret_post. I can't confirm this, but needing to set HTTP auth in FreshRSS and it's done through the apache web server suggests it's the basic auth. Can anyone confirm this?

from freshrss.

Looks like unless overwritten it's client_secret_basic i.e. the token endpoint authentication occurs via the Authorization header using the Basic scheme.

https://github.com/OpenIDC/mod_auth_openidc/blob/72c9f479c2d228477ff0a9518964f61879c83fb6/auth_openidc.conf#L95-L100

from freshrss.