.. meta::
   :description: Advanced guide for extra ThinLinc Web Access OIDC
                 configuration options. This section is for optional
                 things like customizing the login interface and is not
                 required to enable OIDC authentication.

.. _oidc_advanced:

Advanced
--------

This section describes more avanced Web Access configuration options for
customizing the OIDC experience or enabling mutliple providers.

Disabling password login
~~~~~~~~~~~~~~~~~~~~~~~~

By default, Web Access displays both the traditional username/password
form and OIDC login buttons. For info on how to disable the password
form and enforce OIDC-only authentication, see
:servconf:`/webaccess/login/password`. The resulting login page looks
similar to the following figure.

.. figure:: images/tlwebaccess-oidc.svg

   ThinLinc Web Access with OIDC login

Customizing the login page
~~~~~~~~~~~~~~~~~~~~~~~~~~

The OIDC login buttons can be customized with text and icons. Other
parts of the login page can also be customized, as described in
:ref:`tlwebaccess_branding`. Together these options allow for a more
personalized and recognizable page. The configuration can, for example,
look like this:

.. code:: ini

   button_text=Company authentication
   icon_path=/opt/thinlinc/etc/tlwebaccess/company-icon.svg

The parameter :servconf:`/webaccess/oidc/<provider>/button_text`
customizes the button label. The parameter
:servconf:`/webaccess/oidc/<provider>/icon_path` specifies an icon image
(20x20 pixels recommended).

Multiple providers
~~~~~~~~~~~~~~~~~~

Any number of OIDC providers can be configured to allow users to choose.
Multiple providers can be enabled by adding separate configuration
sections, as in the following example:

.. code:: ini

   [/webaccess/oidc/microsoft]
   username_claim=samaccountname
   scope=profile
   discovery_url=https://login.microsoftonline.com/<example-tenant-id>/v2.0/.well-known/openid-configuration
   client_id=<microsoft-client-id>
   client_secret_path=/opt/thinlinc/etc/tlwebaccess/microsoft_secret.txt

   [/webaccess/oidc/keycloak]
   username_claim=preferred_username
   scope=profile
   discovery_url=https://keycloak.example.com/.well-known/openid-configuration
   client_id=<keycloak-client-id>
   client_secret_path=/opt/thinlinc/etc/tlwebaccess/keycloak_secret.txt

Replace the values in the example with proper configuration for each
provider. The parameters |username_claim|, |discovery_url|, |client_id|,
and |client_secret_path| are always required. Users will see separate
login buttons for each configured provider.

.. |username_claim| replace::
   :servconf:`username_claim </webaccess/oidc/<provider>/username_claim>`
.. |discovery_url| replace::
   :servconf:`discovery_url </webaccess/oidc/<provider>/discovery_url>`
.. |client_id| replace::
   :servconf:`client_id </webaccess/oidc/<provider>/client_id>`
.. |client_secret_path| replace::
   :servconf:`client_secret_path </webaccess/oidc/<provider>/client_secret_path>`

.. _tlwebaccess_oidc_integrating:

Integrating into other platforms
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The OIDC login can also be integrated into a different platform or
website, allowing users to log in directly, without first visiting the
Web Access login page. To do this, a direct link including the correct
parameter should be added.

This link can be copied from the respective OIDC button on the Web
Access login page. Alternatively, a HTML link can be created as follows:

.. code:: html

   <a href="https://tl.example.com:300/?oidc=<provider>">
      Log in to ThinLinc
   </a>

In the URL, the ``<provider>`` must match the corresponding folder name
in :servconf:`/webaccess/oidc/\<provider\>` in the configuration, for
example ``microsoft``. Replace the address in the example with the URL
of the server where ThinLinc Web Access is running.

The parameter :servconf:`/webaccess/login_page` can be used to allow
users to return to where they were before logging in.