This page contains instructions on how to set up Signing in with OpenID Connect with various providers such as Authelia, GitLab,. Google. Note that while the configuration reference is correct and up to date, the steps to create the OAuth application might differ slightly as providers change their UI.

## Authelia

1. Generate a client secret:

       authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986

   `Random Password` goes to Trilium, `Digest` (the `$pbkdf2-sha512$…`string) goes to Authelia.

2. Add a client under `identity_providers.oidc.clients` in Authelia's `configuration.yml`, replacing `<server>`with the URL of your Trilium instance:

       identity_providers:
         oidc:
           clients:
             - client_id: 'trilium'
               client_name: 'Trilium'
               client_secret: '<Digest>'
               public: false
               authorization_policy: 'two_factor'
               redirect_uris:
                 - 'https://<server>/callback'
               scopes:
                 - 'openid'
                 - 'profile'
                 - 'email'

   Unlike GitLab, `client_id` is a name you choose rather than one the provider generates.

3. Restart Authelia.

Adjust `config.ini`, using the `Random Password` from step 1:

    [MultiFactorAuthentication]
    oauthBaseUrl=https://<server>
    oauthClientId=<ClientId>
    oauthClientSecret=<RandomPassword>
    oauthIssuerBaseUrl=https://<server>
    oauthIssuerName=Authelia

Do not set `oauthClientAuthMethod` for Authelia. It defaults confidential clients to `client_secret_basic` and rejects any other method with `invalid_client`, which is the default Trilium already uses. This is the opposite of the GitLab case below.

## GitLab (self-hosted or cloud)

1. Go to user settings on gitlab.com or your own self-hosted instance.
2. Press Add new application.
3. Give it a name (e.g. Trilium).
4. Set Redirect URI to `https://<server>/callback`
5. Make sure Confidential is checked and Device authorization grant is unchecked.
6. Under scopes, check openid, profile and email (they should be near the end).
7. Save the application and copy the Application ID and Secret.

Adjust `config.ini` as follows, replacing `<ApplicationId>`and `<Secret>` with the values from the last step as well as the `<server>` with a URL to your Trilium instance.

    [MultiFactorAuthentication]
    oauthBaseUrl=https://<server>
    oauthClientId=<ApplicationId>
    oauthClientSecret=<Secret>
    oauthIssuerBaseUrl=https://gitlab.com
    oauthIssuerName=GitLab
    oauthClientAuthMethod=client_secret_post

If you are using a self-hosted instance of GitLab, make sure to also update `oauthIssuerBaseUrl`, and keep the `oauthClientAuthMethod` line above.

GitLab's token endpoint does not decode credentials sent via HTTP Basic, so without `oauthClientAuthMethod`, sign-in fails with a `server responded with a challenge in the WWW-Authenticate HTTP Header` error. Trilium applies this automatically for `gitlab.com`, but a self-hosted issuer URL cannot be detected.

## GitHub

GitHub cannot be used as an identity provider because it is plain OAuth 2.0 and not OpenID Connect, so it will fail with `OAUTH_RESPONSE_IS_NOT_CONFORM`.

## Google

1. Go to Google Cloud's Clients dashboard and select Create client.
2. For Application type, select Web application.
3. In Authorized redirect URIs, set `https://<server>/callback`.
4. Press Create and copy Client ID and Client secret.

Adjust `config.ini` as follows, replacing `<ClientID>`and `<ClientSecret>` with the values from the last step as well as the `<server>` with a URL to your Trilium instance.

    [MultiFactorAuthentication]
    oauthBaseUrl=https://<server>
    oauthClientId=<ClientID>
    oauthClientSecret=<ClientSecret>