Authelia | 身份提供商

用 Authelia 登录 Casdoor

Q: Which authorization policy should I use?

two_factor makes people complete Authelia's second factor before they reach Casdoor. Use one_factor if a password is enough, for example because Casdoor applications ask for MFA themselves.

Authelia's OpenID Connect provider lets other apps sign people in with their Authelia accounts and second factor. Add it to Casdoor, and your Casdoor applications get the same sign-in.

Casdoor 官方核验OIDCPKCE自托管

开始配置查看源码

你需要一个正在运行的 Casdoor，自己部署或用 Casdoor 云都可以。示例中的 https://auth.example.com 请换成你的 Casdoor 地址（Casdoor 云上类似 https://acme.casdoor.com），其他 example.com 地址也换成你自己的。

用 Casdoor 配置 Authelia

1
Generate a client secret
Authelia stores client secrets hashed. This prints a random secret and its digest: Casdoor gets the secret, Authelia's configuration the digest.
```
authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
```

Register Casdoor as a client

Add a client to Authelia's configuration, choosing any client ID, and restart Authelia.

identity_providers:
  oidc:
    clients:
      - client_id: '<client ID>'
        client_name: 'Casdoor'
        client_secret: '<digest from the previous step>'
        public: false
        authorization_policy: 'two_factor'
        redirect_uris:
          - 'https://auth.example.com/callback'
        scopes: ['openid', 'profile', 'email']
        response_types: ['code']
        grant_types: ['authorization_code']
        token_endpoint_auth_method: 'client_secret_basic'

在 Casdoor 中添加 Authelia 提供商

在 Casdoor 控制台打开 提供商，点击添加，填写：

类别	OAuth
类型	OIDC
显示名称	Authelia
客户端ID	<client ID>
客户端密钥	<client secret>
Issuer链接	https://authelia.example.com
认证URL	https://authelia.example.com/api/oidc/authorization
Token链接	https://authelia.example.com/api/oidc/token
范围	openid profile email
UserInfo链接	https://authelia.example.com/api/oidc/userinfo
启用PKCE	开启

点击 Issuer链接旁边的请求，会从 Authelia 的 discovery 文档自动填好其余地址。同一个组织里所有 OIDC 类型的提供商都通过同一个字段关联用户，所以如果这个组织已经有一个 OIDC 提供商，请把类型改成 Custom Flexible，它按提供商分别关联账号。

4
把提供商加到应用上
打开应用，编辑用户登录的那个应用，在它的 提供商 标签页添加这个提供商。之后登录页上就会出现 Authelia 按钮。

注意事项

Authelia doesn't support RP-initiated logout, so signing out of Casdoor leaves the Authelia session alone.
Authelia keeps the ID token minimal and returns the profile and email claims from its userinfo endpoint, which Casdoor reads, so no claims_policy is needed.
If the discovery document shows wrong URLs, check the X-Forwarded-Proto and Host headers your reverse proxy sends to Authelia.

Authelia 的设置取自它的官方文档（核对于 2026年10月：Authelia OpenID Connect、Authelia OIDC clients、Authelia OIDC claims）。Authelia 是其所有者的商标。

常见问题

Which authorization policy should I use?

two_factor makes people complete Authelia's second factor before they reach Casdoor. Use one_factor if a password is enough, for example because Casdoor applications ask for MFA themselves.

Why client_secret_basic?

It is Authelia's default and the method Casdoor tries first.

用 Authelia 登录 Casdoor

用 Casdoor 配置 Authelia

Generate a client secret

Register Casdoor as a client

在 Casdoor 中添加 Authelia 提供商

把提供商加到应用上

注意事项

常见问题

更多身份提供商

authentik

GitLab Self-Managed

Keycloak