# OIDC

Outline supports all OIDC-compatible authentication providers and automatic discovery out of the box. 

# Automatic discovery

Using automatic discovery Outline will expect to find a `/.well-known/openid-configuration` file on the server at your issuer URL and will configure the rest of the settings on startup.

* `OIDC_ISSUER_URL` – The URL of your OIDC server
* `OIDC_CLIENT_ID` – OAuth client ID
* `OIDC_CLIENT_SECRET` – OAuth client secret

# Manual discovery

You can also provide the OIDC configuration manually as environment variables; the following values are all required if configuring manually:

* `OIDC_CLIENT_ID` – OAuth client ID
* `OIDC_CLIENT_SECRET` – OAuth client secret
* `OIDC_AUTH_URI`
* `OIDC_TOKEN_URI`
* `OIDC_USERINFO_URI`


# Optional setup

Note, one of the following should be set or it will be very difficult for users to logout correctly:

* `OIDC_DISABLE_REDIRECT` – If set, will prevent Outline from automatically redirecting to the OIDC provider
* `OIDC_LOGOUT_URI` – A url that the client will be redirect to post-logout


The following configuration is *optional*:

* `OIDC_USERNAME_CLAIM` – Supports any valid JSON path with the JWT payload (`preferred_username` by default)
* `OIDC_DISPLAY_NAME` – The text that should be displayed on the login button (`OpenID` by default)
* `OIDC_SCOPES` – The scopes to request (`openid profile email` by default)


## Examples

OIDC providers will often publish the correct values for these at the “.well-known” url, some examples that could be used to sign-in to Outline using this method include:


* **GitLab**: <https://gitlab.com/.well-known/openid-configuration>
* **Apple**: <https://appleid.apple.com/.well-known/openid-configuration>
* **Twitch:** <https://id.twitch.tv/oauth2/.well-known/openid-configuration>
* **Facebook:** <https://www.facebook.com/.well-known/openid-configuration>
* **Keycloak:** <https://www.keycloak.org/> (self-hosted)
* **Mattermost:** <https://developers.mattermost.com/integrate/admin-guide/admin-oauth2/#oauth-endpoints> (self-hosted and cloud)
* **Authelia:** <https://www.authelia.com/integration/openid-connect/outline/> (self-hosted)
* **Authentik**: <https://docs.goauthentik.io/integrations/services/outline/> (self-hosted)

---

**Documents**

- [License restrictions](https://docs.getoutline.com/s/hosting/doc/license-restrictions-f9aq6uEL3H)
- [Requirements](https://docs.getoutline.com/s/hosting/doc/requirements-ULdYnwi4wG)
- [Installation methods](https://docs.getoutline.com/s/hosting/doc/installation-methods-pSvgz9j0QC)
- [Configuration](https://docs.getoutline.com/s/hosting/doc/configuration-509J4lAzjo)
- [Business + Enterprise](https://docs.getoutline.com/s/hosting/doc/business-enterprise-rv0715NxO3)
- [Backups](https://docs.getoutline.com/s/hosting/doc/backups-KZtPOADCHG)
- [Troubleshooting](https://docs.getoutline.com/s/hosting/doc/troubleshooting-HXckrzCqDJ)