OIDC

Configuration

Omitted fields inherit from the matching GODOXY_OIDC_* environment variable. The middleware can run with a fully standalone issuer and credentials; global OIDC does not need to be enabled for the WebUI.

After inheritance, issuer_url, client_id, client_secret, and scopes are required, and at least one of allowed_users or allowed_groups must be set. scopes accepts a YAML list or a comma-separated string.

See OIDC Configuration for environment variables, callback URLs, and identity-provider setup.

Standalone issuer

Use issuer_url when the identity provider issues a different issuer per application, for example Authentik (https://auth.example.com/application/o/<slug>/). Discovery and token verification then use that issuer instead of the global one.

Providers that share the same issuer and client ID reuse discovery and verifier state. Route-specific secrets, scopes, and allow lists stay per middleware.

Examples

WebUI

Enabled by default if the global OIDC environment variables are set.

Entrypoint

entrypoint:
  middlewares:
    - use: oidc
      bypass:
        - route pocket-id
        - route immich & path glob(/api/*)
        - remote 127.0.0.1
        - remote 192.168.0.0/16

Docker Labels

proxy.#1.middlewares.oidc: |
  issuer_url: https://auth.example.com/application/o/app-b/
  allowed_users: user1, user2
  allowed_groups: group1, group2
  client_id: client1
  client_secret: secret1
  scopes:
    - openid
    - profile
    - email
    - groups

A comma-separated string is also accepted: scopes: openid, profile, email, groups.

Route Files

myapp:
  middlewares:
    oidc:
      issuer_url: https://auth.example.com/application/o/app-b/
      allowed_users:
        - user1
        - user2
      allowed_groups:
        - group1
        - group2
      client_id: client1
      client_secret: secret1
      scopes:
        - openid
        - profile
        - email
        - groups