.. meta::
   :description: Guide to configuring OpenID Connect (OIDC) authentication
                 for ThinLinc Web Access, enabling single sign-on with
                 external providers.

.. _authentication_oidc:

OpenID Connect
==============

ThinLinc Web Access supports authentication via OpenID® Connect (OIDC),
allowing users to authenticate through an external identity provider
such as Microsoft Entra® ID or Keycloak®. This enables single sign-on
(SSO) in Web Access and smooth authentication integration. For the
native client, it is possible to configure single sign-on through
Kerberos, see :ref:`Kerberos authentication
<client_options_security_kerberos>`.

When OIDC authentication is enabled, users are redirected to the
provider for authentication. After the provider verifies the user's
credentials, ThinLinc authorizes the user through PAM. The username must
match a valid Linux user account, and standard PAM authorization rules
apply, including account expiration, access restrictions, and other
policies configured in :file:`/etc/pam.d/`.

.. note::

   Users must exist as valid Linux accounts on the ThinLinc server.
   ThinLinc does not automatically create user accounts based on OIDC
   authentication. The provider handles authentication, while ThinLinc
   handles authorization and account validation through PAM.

This feature will let users to log in at a provider, but it should be
noted that logging out of ThinLinc will not log the user out at the
provider.

Before configuring OIDC authentication, ensure the following
requirements are met:

- An OIDC application can be registered at your provider
- The provider has a valid TLS certificate that is trusted by the
  ThinLinc server
- User directory integration (i.e. LDAP, IPA or Active Directory) is
  configured and users can be resolved (with :command:`getent` for
  example)

.. toctree::
   :hidden:

   oidc_provider
   oidc_config
   oidc_advanced