owen/lms
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add OIDC
Basic Build (Arch) / Build (push) Canceled after 0s
Details
clang-format Check / Formatting Check (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
owen
2026-08-19 22:00:14 -05:00
parent bf2fa21e95
commit 06ca52c261
13 changed files with 201 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
INSTALL.md
+2 -1
View File
@@ -108,6 +108,7 @@ You can define which authentication backend to be used thanks to the `authentica
* `internal` (default): _LMS_ uses an internal database to store users and their associated passwords (salted and hashed using [Bcrypt](https://en.wikipedia.org/wiki/Bcrypt)). Only the admin user can create, edit or remove other users.
* `PAM`: the user/password authentication request is forwarded to PAM. A default example PAM configuration file is provided at [`conf/pam/lms`](conf/pam/lms), which demonstrates how to authenticate using system passwords. **Note:** this file is just a base example; depending on your PAM setup, you may need to adjust the service file or PAM rules to ensure proper privileges.
* `http-headers`: _LMS_ uses a configurable HTTP header field, typically set by a reverse proxy to handle [SSO](https://en.wikipedia.org/wiki/Single_sign-on), to extract the login name. You can customize the field to be used using the `http-headers-login-field` option.
* `oidc`: _LMS_ authenticates users through an OpenID Connect provider using the authorization code flow. Configure the client and provider endpoints with the `oidc-*` options in `lms.conf`, set `public-url`, and register `<public-url>/oidc/callback` as the client redirect URI. Users are created automatically on first login; the first user is an administrator. By default the stable `sub` claim is used as the LMS login name; `email` (verified addresses only) and `name` are also supported through `oidc-login-name-claim`.
__Note__: the first created user is the admin user.
### `internal` backend: reset admin password
Open the the database file located in `/var/lms/lms.db` using `sqlite3`:
@@ -179,4 +180,4 @@ __Note__: If you are using `PAM` or `http-header` authentication, this setup ass
Once logged in as an administrator, you will need to define your libraries—that is, select the music folders you want to scan. Then, check that the scan settings meet your needs (scan frequency, tag delimiters, etc.).
You can now initiate the initial scan to import your music into _LMS_.
You can now initiate the initial scan to import your music into _LMS_.