Sign-in source
Choose where people sign in to an app: Authelia, the app's own login, or an outside OpenID Connect provider.
By default an app signs people in with Authelia, or with its own login when it cannot use Authelia. For a few apps you can change that, one app at a time.
The Authelia gate, per app#
Authelia can stand in front of an app so nobody reaches it without signing in. In Admin → Tools → Single sign-on, each app has a Sign-in source panel where you can turn the gate off for that app. If the app has no login of its own, LibrePortal asks you first, because turning the gate off would leave it open.
libreportal app auth forgejo --gate off
libreportal app auth forgejo --gate authelia
An outside provider (Forgejo and Gitea)#
Forgejo and Gitea can also sign people in through an outside OpenID Connect provider, beside Authelia: people see a button for it on the app's sign-in page.
libreportal app auth forgejo --oidc-provider https://id.example.org \
--client-id forgejo --client-secret secret:<ref> --button-label "Sign in with Example"
libreportal app auth forgejo --remove-oidc-provider
libreportal app auth forgejo --show
LibrePortal checks the provider first: the address must be https (or http on a private address) and its discovery document must answer. The client secret goes into the secret store and is never shown in a command or a log.
It stays put#
Your choice is kept through updates, restores and even reinstalling Authelia. A reinstalled Authelia does not put the gate back in front of an app you moved to an outside provider.
Another service can read and change this with an apps:auth-write access key.