Provider¶
Before configuring ThinLinc, you must register it as an OIDC application in your provider. While the exact steps vary by provider, the following information is typically required:
Redirect URI¶
The redirect URI specifies where the provider redirects users after authentication:
https://<thinlinc-server>:<port>/
For example: https://thinlinc.example.com:300/
The redirect URI must:
Use HTTPS (HTTP is not supported)
Include the trailing slash (
/)Match the ThinLinc Web Access URL exactly (case-sensitive)
Use port 300 by default (or your configured Web Access port)
If using Web Access behind a reverse proxy, use the proxy’s URL
Note that providers often allow multiple redirect URIs. This can be useful if the ThinLinc server can be reached from multiple addresses.
Scopes¶
The provider must include the correct OAuth 2.0 scopes needed for the
username claim, see Username mapping. An
example is the profile scope that sometimes include claims which are
commonly used for username mapping. Some providers also allow custom
scopes to be added. Consult your provider’s documentation for details on
available scopes and how to configure them.
The openid scope is mandatory and must be supported by the provider.
The optional /webaccess/oidc/<provider>/scope parameter
can be used to configure ThinLinc to request other scopes in addition to
openid. Scopes requested by ThinLinc should be a subset of, or the
same as, the scopes available from the provider.
Authentication flow¶
Configure the application to use code as the Authorization Code Flow. This is the authentication flow supported by ThinLinc.
Finalize registration¶
Complete the registration of the application, consult your provider’s documentation for detailed instructions. After registration, collect the following values from your provider:
Client ID
Client Secret
Discovery URL (must end with
.well-known/openid-configuration)
