Setting up with various providers

Authelia#

  1. Generate a client secret:

    authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986

    Random Password goes to Trilium, Digest (the $pbkdf2-sha512$… string) goes to Authelia.

  2. Add a client under identity_providers.oidc.clients in Authelia's configuration.yml, replacing <server> with the URL of your Trilium instance:

    identity_providers:
  oidc:
    clients:
      - client_id: 'trilium'
        client_name: 'Trilium'
        client_secret: '<Digest>'
        public: false
        authorization_policy: 'two_factor'
        redirect_uris:
          - 'https://<server>/callback'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'

    Unlike GitLab, client_id is a name you choose rather than one the provider generates.

  3. Restart Authelia.

Adjust config.ini, using the Random Password from step 1:

[MultiFactorAuthentication]
oauthBaseUrl=https://<server>
oauthClientId=<ClientId>
oauthClientSecret=<RandomPassword>
oauthIssuerBaseUrl=https://<server>
oauthIssuerName=Authelia

GitLab (self-hosted or cloud)#

  1. Go to user settings on gitlab.com or your own self-hosted instance.
  2. Press Add new application.
  3. Give it a name (e.g. Trilium).
  4. Set Redirect URI to https://<server>/callback
  5. Make sure Confidential is checked and Device authorization grant is unchecked.
  6. Under scopes, check openid, profile and email (they should be near the end).
  7. Save the application and copy the Application ID and Secret.

Adjust config.ini as follows, replacing <ApplicationId> and <Secret> with the values from the last step as well as the <server> with a URL to your Trilium instance.

[MultiFactorAuthentication]
oauthBaseUrl=https://<server>
oauthClientId=<ApplicationId>
oauthClientSecret=<Secret>
oauthIssuerBaseUrl=https://gitlab.com
oauthIssuerName=GitLab
oauthClientAuthMethod=client_secret_post

GitHub#

GitHub cannot be used as an identity provider because it is plain OAuth 2.0 and not OpenID Connect, so it will fail with OAUTH_RESPONSE_IS_NOT_CONFORM.

Google#

  1. Go to Google Cloud's Clients dashboard and select Create client.
  2. For Application type, select Web application.
  3. In Authorized redirect URIs, set  https://<server>/callback.
  4. Press Create and copy Client ID and Client secret.

Adjust config.ini as follows, replacing <ClientID> and <ClientSecret> with the values from the last step as well as the <server> with a URL to your Trilium instance.

[MultiFactorAuthentication]
oauthBaseUrl=https://<server>
oauthClientId=<ClientID>
oauthClientSecret=<ClientSecret>