dandri/continuwuity
1
0
Fork 0
mirror of https://forgejo.ellis.link/continuwuation/continuwuity/ synced 2026-10-12 17:17:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

docs(auth): Incorporate changes from PR review comments

Browse Source
This commit is contained in:
stratself
2026-09-29 16:26:07 +00:00
committed by Ellis Git
parent f35eb7677c
commit f49bda81d2
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/authentication/internal.mdx
+3 -3
View File
@@ -4,20 +4,20 @@ # Internal authentication
## Registration
Registration is disabled by default. To enable it, set `allow_registration = true` in your config file and configure at least one of the registration methods below.
Registration is disabled by default. To enable it, set `allow_registration = true` in your config file and use at least one of the registration methods below.
| Method | Description | Additional configuration needed |
| ------ | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| 1 | Admin-issued tokens (recommended) | None. Use the [`!admin token issue`](../reference/admin/token#admin-token-issue) command |
| 2 | Static registration token | `registration_token` or `registration_token_file` |
| 3 | reCAPTCHA-only registration | `recaptcha_site_key` and `recaptcha_private_site_key` |
| 4 | Email only registration | `require_email_for_registration = true` in `[global.smtp]` section. See [Email configuration](#email-configuration) |
| 4 | Email-only registration | `require_email_for_registration = true` in `[global.smtp]` section. See [Email configuration](#email-configuration) |
| 5 | Static token + reCAPTCHA | Methods 2 + 3 |
| 6 | Email + reCAPTCHA | Methods 3 + 4 |
| 7 | Static token + email | Method 2 + `require_email_for_token_registration = true` in `[global.smtp]`. See [Email configuration](#email-configuration) |
| 8 | Static token + email + reCAPTCHA | Methods 3 + 7 |
Users can register on Continuwiity's account management page, or directly within a Matrix client if legacy login is enabled.
Users can register on Continuwuity's account management page, or directly within a Matrix client if legacy login is enabled.
Admin-issued tokens are the recommended method of registration. These tokens can be scoped with an expiry duration or maximum times used, and are suited for private/invite-only homeservers. See the [`!admin token`](../reference/admin/token) commands for more details.
docs/authentication/oidc.mdx
+6 -6
View File
@@ -14,7 +14,7 @@ ## Instructions
### Configuring the OIDC provider
This guide will use [**kanidm**][kanidm] as an example, but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
This guide will use [**Kanidm**][kanidm] as an example, but the described steps are broadly applicable to other identity providers. Contributions for them are welcome.
First, create a new application for Continuwuity in your identity provider.
@@ -74,11 +74,7 @@ ## Advanced options
### Minting tokens for non-OIDC accounts
With OIDC delegation enabled, accounts without an OIDC mapping can still be created (via `!admin users create`), but will not be able to log in to the homeserver. To accommodate this, homeserver admins can use the [`!admin users issue-token`](../reference/admin/users#admin-users-issue-token) command to issue tokens for them. This command requires the account to have set a local password, which can be done with [`!admin users reset-password`](../reference/admin/users#admin-users-reset-password).
### Decommissioning OIDC delegation
It is possible to revert to using the internal database for authentication. First, uncomment the `[global.oauth.oidc]` section in your config file and restart the homeserver. Then, execute the [`!admin users reset-password --convert-to-local-account`](../reference/admin/users#admin-users-reset-password) for each user, to assign them a local password and convert their linked accounts into local ones.
With OIDC delegation enabled, accounts without an OIDC mapping (such as bot accounts) can still be created via the admin commands, but will not be able to log in to the homeserver. To accommodate this, homeserver admins can use the [`!admin users issue-token`](../reference/admin/users#admin-users-issue-token) command to issue tokens for them. This command requires the account to have set a local password, which can be done with [`!admin users reset-password`](../reference/admin/users#admin-users-reset-password).
### Manually linking users to OIDC claims
@@ -99,3 +95,7 @@ ### Manually linking users to OIDC claims
("1d3fc994-3947-406d-b22c-0fc529baf235", "john")
("721c36a8-ce04-4474-8e97-b62655b07340", "jane")
```
### Decommissioning OIDC delegation
It is possible to revert to using the internal database for authentication. First, comment out the `[global.oauth.oidc]` section in your config file and restart the homeserver. Then, execute the [`!admin users reset-password --convert-to-local-account`](../reference/admin/users#admin-users-reset-password) for each user, to assign them a local password and convert their linked accounts into local ones.