add OIDC

conf/lms.conf

@@ -74,12 +74,24 @@ lastfm-submit-period-hours = 1;
 acousticbrainz-api-base-url = "https://acousticbrainz.org";
 
 # Authentication
-# Available backends: "internal", "PAM", "http-headers"
+# Available backends: "internal", "PAM", "http-headers", "oidc"
 authentication-backend = "internal";
 # The number of bcrypt rounds to be used when backend is set to "internal". The higher the more secure
 internal-password-bcrypt-round = 12;
 # The header to be used to read the authentication user when backend is set to "http-headers"
 http-headers-login-field = "X-Forwarded-User";
+# OpenID Connect settings (used when authentication-backend is "oidc").
+# public-url must also be set, and <public-url>/oidc/callback must be registered
+# as an allowed redirect URI at the identity provider.
+oidc-client-id = "";
+oidc-client-secret = "";
+oidc-authorization-endpoint = "";
+oidc-token-endpoint = "";
+oidc-userinfo-endpoint = "";
+oidc-scope = "openid profile email";
+oidc-provider-name = "OpenID Connect";
+# Login name source: "sub" (stable provider subject), "email" (must be verified), or "name".
+oidc-login-name-claim = "sub";
 
 # Max entries in the login throttler (1 entry per IP address. For IPv6, the whole /64 block is used)
 login-throttler-max-entries = 10000;