OAuth 2
Accounts in Shale are not owned by the instance, instead account management is deffered to an external identity provider using OAuth 2. OAuth 2.0 is the industry-standard protocol for authorization.
You can enable an OAuth 2 identity provider in Shale by setting the OAUTH2_CLIENT environment variable during installation.
The OAUTH2_CLIENT environment variable may take two forms depending on which kind of provider you choose to use.
The first is for hosted first-party providers.
OAUTH2_CLIENT: foo|client_id|client_secret
The second is providers that you may host on your own infrasturcture or are provided your own tenant of.
OAUTH2_CLIENT: foo,bar.my.server|client_id|client_secret
Creating Credentials
Section titled “Creating Credentials”When creating a client with your Identity Provider of choice in order to obtain an ID and Secret, one of the pieces of information that it will ask for is a callback/redirect URL.
For Shale this should look like http://localhost/-/callback but customized to use your own domain.
Providers
Section titled “Providers”Below is the full list of identity providers you may use with Shale:
| Provider | Short Code | Developer Portal |
|---|---|---|
| Amazon | amazon | https://developer.amazon.com/settings/console/securityprofile/overview.html |
| Battle.net | battle.net | https://develop.battle.net/access/clients |
| Discord | discord | https://discordapp.com/developers/applications/ |
facebook | https://developers.facebook.com/apps/ | |
| GitHub | github | https://github.com/settings/developers |
google | https://console.developers.google.com | |
| Microsoft | microsoft | https://apps.dev.microsoft.com/ |
reddit | https://www.reddit.com/prefs/apps | |
| Railway | railway | https://railway.com/workspace/developer |
| Provider | Short Code | Home |
|---|---|---|
| Gitea | gitea | https://gitea.io/en-us/ |
| Forgejo | forgejo | https://forgejo.org/ |
| Codeberg | forgejo,codeberg.org | https://codeberg.org/user/settings/applications |
| Gitlab | gitlab | https://about.gitlab.com/ |
| GitLab | gitlab,gitlab.com | https://gitlab.com/profile/applications |
| mastodon | mastodon | https://joinmastodon.org/ |
| pleroma | pleroma | https://pleroma.social/ |
OpenID Connect
Section titled “OpenID Connect”Shale additionally supports any OpenID Connect-compatible identity provider. You can confirm this by checking your provider’s docs or if your host exposes a /.well-known/openid-configuration endpoint.
Use the "oidc" provider key to get started: OAUTH2_CLIENT: oidc,auth.my.server|client_id|client_secret.
Users of Keycloak may additionally have to provide the realm path, eg. OAUTH2_CLIENT: oidc,auth.my.server/realms/master|client_id|client_secret.