From 97533eea05b2c2b7ed23688d975948876af322be Mon Sep 17 00:00:00 2001 From: stratself Date: Sat, 12 Sep 2026 05:48:14 +0000 Subject: [PATCH] docs(auth): Writeup on auth sources and flows --- docs/authentication.mdx | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/docs/authentication.mdx b/docs/authentication.mdx index e9d899fa0..465ec857a 100644 --- a/docs/authentication.mdx +++ b/docs/authentication.mdx @@ -1,5 +1,30 @@ # Authentication -{/* TODO: explain internal authn vs delegated authn */} +This chapter describes various ways to authenticate to Continuwuity. -{/* TODO: consider explaining UIA authz versus OAuth authz here */} \ No newline at end of file +## Authentication flows + +Continuwuity implements the following authentication flows: + +- **OAuth login** (also known as **next-gen auth**): clients redirect the user to Continuwuity's login/signup page. +- **Legacy login** (also known as the **UIAA** framework): clients logs in/signs up directly to the server via its own UI. + +Different sets of clients support different flows, but most clients are moving towards next-gen auth. One can set which login mode(s) are allowed via the `compatibility_mode` variable of the `[global.oauth]` config file section. + +## Authentication sources + +Continuwuity can read user authentication data from the following sources: + +- **Internal database** - this is the default setup, which allows for self-service registration and email configuration. +- **Delegated authentication** - the server connects to an OpenID Connect identity provider for user authentication. This is useful for Single-Sign On against a central identity directory. + +:::important Delegated authentication and legacy logins +When configuring Delegated authentication, **legacy login will be implicitly disabled** and local passwords made redundant. +::: + +## Further reading + +See the following pages for further details: + +- [**Registration and email configuration**](./authentication/registration) +- [**Delegated authentication**](./authentication/oidc) \ No newline at end of file