Forgejo config #4045

Weissnix4711 · 2026-01-07T00:34:09Z

Weissnix4711
Jan 7, 2026

Similar to gittea, but actually supports PKCE. also here is my config for the other claims too, I hope it may be useful to someone.

Forgejo

Site administration -> identity & access -> authentication sources -> add

Authentication type: Oauth2
Authentication name: <whatever you want> eg. kanidm (must match callback url)
OAuth2 provider: OpenID Connect
Client ID: <client id>
Client Secret: <secret>
OpenID Connect Auto Discovery URL: https://idm.example.net/oauth2/openid/forgejo/.well-known/openid-configuration
Skip Local 2FA: your preference. by default kanidm will have 2fa for password login anyway so I would enable this
Allow username change: your preference
Additional scopes: email ssh_publickeys
Required claim name: <leave blank> if you dont want users to be able to sign in, just remove them from forgejo_users
Required claim value:  <blank>
Claim name providing group names for this source: forgejo_role
Group claim value for administrator users: admin
Group claim value for restricted users: restricted (or blank if not used)

kanidm

kanidm group create forgejo_users
kanidm group create forgejo_admins
kanidm system oauth2 create forgejo "Forgejo Instance" https://git.example.net
kanidm system oauth2 add-redirect-url forgejo https://git.example.net/user/oauth2/<authentication name>/callback
# forgejo users cannot have '@' in name, so use short username instead
kanidm system oauth2 prefer-short-username forgejo
kanidm system oauth2 update-scope-map forgejo forgejo_users openid email profile ssh_publickeys
kanidm system oauth2 update-claim-map forgejo forgejo_role forgejo_admins admin
# etc. for forgejo_role forgejo_restricted restricted
kanidm system oauth2 show-basic-secret forgejo
# <secret>

`app.ini`

[service]
; allow registration only via oidc
DISABLE_REGISTRATION = false
ALLOW_ONLY_EXTERNAL_REGISTRATION = true
; optionally disable password login via ui
ENABLE_PASSWORD_SIGNIN_FORM = false
; and for api access
ENABLE_BASIC_AUTHENTICATION = false

; note that this section is not for openid connect
; and is probably not what you're looking for
[openid]
ENABLE_OPENID_SIGNIN = false

Also note as of 13.0 there seems to be a bug where a users does not get admin permissions on registration, but must logout and back in again first.

arichtman · 2026-01-11T11:23:07Z

arichtman
Jan 11, 2026

Awesome stuff! Just in time as I set this up tonight!

One thing I noticed is ENABLE_PASSWORD_SIGNIN_FORM seems to be ENABLE_INTERNAL_SIGNIN now.

I also set the following via config ini -

[oauth2_client]
; This presumably sets defaults for all clients?
OPENID_CONNECT_SCOPES = email profile ssh_publickeys
; This didn't seem to be an option in the GUI, though Kanidm/vanilla OIDC might not support it
UPDATE_AVATAR = true

6 replies

Weissnix4711 Jan 11, 2026
Author

TIL that OIDC supports an SSH public key scope, and Forgejo accepts it.

From my understanding OIDC scopes are pretty arbitrary, and ssh_publickeys is just made up by kanidm to allow access to the claim with the same name. I don't think much of this is standardised, but kanidm originally implemented it for gitlab?

arichtman Jan 12, 2026

Man it'd be cool to have a plugin system for claims...

Weissnix4711 Jan 12, 2026
Author

Man it'd be cool to have a plugin system for claims...

what do you mean by this? you can create custom claims right now, albeit only based on group memberships.

Firstyear Jan 13, 2026
Maintainer

A common request is claim templating or scripting.

We are more likely to do "templating", as scripting claim values could be a security risk.

Firstyear Jan 13, 2026
Maintainer

From my understanding OIDC scopes are pretty arbitrary, and ssh_publickeys is just made up by kanidm to allow access to the claim with the same name.

This is correct. Scope values are "just strings" and it's up to each end how they interpret them.

Gabgobie · 2026-01-24T16:56:22Z

Gabgobie
Jan 24, 2026

Thanks! This was extremely helpful. I already had it running but couldn't find the scope for ssh pubkeys anywhere in the docs.

1 reply

Firstyear Jan 28, 2026
Maintainer

https://kanidm.github.io/kanidm/stable/integrations/oauth2.html#create-the-kanidm-configuration

They're here in the custom scope behaviour section.

tacerus · 2026-04-30T17:49:53Z

tacerus
Apr 30, 2026

Thanks for the hints.
I found Public SSH key attribute also needs to be set to ssh_publickeys in order for the SSH key sync to get engaged during login.

Edit: some more hints, Foregejo also allows to manage organization/team membership through claims:

kanidm system oauth2 update-claim-map forgejo forgejo_group <kanidm group> forgejo-devs

And in Forgejo, set Map claimed groups to organization teams. to a JSON such as {"forgejo-devs": {"<organization>": ["<team>"]}} and tick Remove users from synchronized teams if user does not belong to corresponding group.

0 replies

andreas-bulling · 2026-07-07T14:51:20Z

andreas-bulling
Jul 7, 2026

I followed your instructions and everything works fine - thanks a lot for that!

However, it seems there is no way for Forgejo to create new users logging in for the first time. And there is also always the need to link the two systems in "Profile" -> "Security" (which a new user can't reach because Forgejo doesn't create a new account)

Are there solutions to these two problems?

1 reply

ophilli Jul 7, 2026

The following options are working well for me. I can create users for my friends in kanidm or PocketID and then add them to my forgejo group in the IDM and they have no issue using the OIDC flow to login & forgejo has no issue making an account the first time it sees that OIDC user.

service.DISABLE_REGISTRATION = false;
      service.ENABLE_INTERNAL_SIGNIN = false;
      service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
      service.SHOW_REGISTRATION_BUTTON = false;

andreas-bulling · 2026-07-29T11:51:40Z

andreas-bulling
Jul 29, 2026

I got this working but I noticed that the Full name remains empty for new users that have signed up through OIDC.

And that the Authentication sign-in name is set to the internal kanidm uuid while it would be nice to have the (short) username instead.

Is that possible?

10 replies

andreas-bulling Jul 29, 2026

That setting I had already changed, yet, Forgejo still uses the uuid instead of the username for new accounts... :-/

nickname is not really included by default in kanidm, i.e. I'd have to add a custom claim?!

Gabgobie Jul 29, 2026

That setting I had already changed, yet, Forgejo still uses the uuid instead of the username for new accounts... :-/

That shouldn‘t be the case but blind debugging is also usually not very productive.

Would you mind posting your docker-compose, forgejo authentication settings and kani oauth2 service settings kanidm system oauth2 get <forgejo> (ofc redacting any sensitive values)?

nickname is not really included by default in kanidm, i.e. I'd have to add a custom claim?!

A custom claim won‘t help you much until templating is a thing. Custom claims maps currently allow you to return a static value per group membership.

If I‘m not mistaken, it should be exposed on the name claim. That’s the one my Nextcloud uses and it works perfectly fine.

nickname is part of the standard claims list though: https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims

Firstyear Jul 30, 2026
Maintainer

That setting I had already changed, yet, Forgejo still uses the uuid instead of the username for new accounts... :-/

https://forgejo.org/docs/next/admin/config-cheat-sheet/#oauth2-client-oauth2_client

userid is correctly set to the sub attribute which is a uuid. You should have the preferred_username option set I guess?

andreas-bulling Jul 30, 2026

That‘s the git oauth helper‘s job. Git works fine over the command line + https. They just need to be able to open a browser window once for the authentication process. For any headless machines I‘d use an ssh key which I think always uses the git@<instance> username.

I actually hit this problem myself now.. How is the authentication process (and opening of the browser window) triggered from the CLI?

Gabgobie Jul 30, 2026

Usually it's this: https://github.com/hickford/git-credential-oauth

red-lichtie · 2026-10-07T15:38:12Z

red-lichtie
Oct 7, 2026

Here is how I configured my instance in kanidm.

Create application

kanidm -D idm_admin system oauth2 create forgejo "Forgejo Server" https://forgejo.lan.internal/
kanidm -D idm_admin system oauth2 prefer-short-username forgejo

Get the secret required for the configuration

kanidm -D idm_admin system oauth2 show-basic-secret forgejo

Add redirect URI

kanidm -D idm_admin system oauth2 add-redirect-url forgejo https://forgejo.lan.internal/user/oauth2/kanidm/callback

Application logo

curl -O https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/png/forgejo.png
kanidm -D idm_admin system oauth2 set-image forgejo forgejo.png

Set the allowed scopes for the application forgejo for members of the group forgejo_users the scopes MUST include forgejo_roles

kanidm -D idm_admin system oauth2 update-scope-map 'forgejo' 'forgejo_users' forgejo_roles email openid profile

Groups

kanidm -D idm_admin group create forgejo_users
kanidm group set-description 'forgejo_users' 'Users'

kanidm -D idm_admin group create forgejo_admins
kanidm group set-description 'forgejo_admins' 'Administrators'

Join forgejo_roles claim set to the forgejo application claims

kanidm -D idm_admin system oauth2 update-claim-map-join 'forgejo' 'forgejo_roles' array

kanidm -D idm_admin system oauth2 update-claim-map 'forgejo' 'forgejo_roles' 'forgejo_users' 'ForgejoUser'
kanidm -D idm_admin system oauth2 update-claim-map 'forgejo' 'forgejo_roles' 'forgejo_admins' 'ForgejoAdministrator'

0 replies

Forgejo config #4045

Uh oh!

Uh oh!

Forgejo

kanidm

app.ini

Replies: 6 comments · 18 replies

Uh oh!

Uh oh!

Weissnix4711 Jan 11, 2026 Author

Uh oh!

Uh oh!

Weissnix4711 Jan 12, 2026 Author

Uh oh!

Firstyear Jan 13, 2026 Maintainer

Uh oh!

Firstyear Jan 13, 2026 Maintainer

Uh oh!

Uh oh!

Firstyear Jan 28, 2026 Maintainer

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Firstyear Jul 30, 2026 Maintainer

Uh oh!

Uh oh!

Uh oh!

`app.ini`

Replies: 6 comments 18 replies

Weissnix4711 Jan 11, 2026
Author

Weissnix4711 Jan 12, 2026
Author

Firstyear Jan 13, 2026
Maintainer

Firstyear Jan 13, 2026
Maintainer

Firstyear Jan 28, 2026
Maintainer

Firstyear Jul 30, 2026
Maintainer