@@ -0,0 +3,4 @@
+Continuwuity supports delegating user authentication to an external identity provider that implements the OpenID Connect specification, such as Authentik, kanidm, or Keycloak.
+
+:::warning{title="OIDC versus OAuth, and supported clients"}
+**OIDC** is not to be confused with **OAuth**. In the context of Matrix, OAuth is the protocol that Matrix clients use to authenticate with the _homeserver_. OIDC is the protocol that the _homeserver_ uses to communicate with the _identity provider_. Continuwuity supports OAuth by default, alongside the legacy **UIAA** authentication framework.

@@ -0,0 +5,4 @@
+:::warning{title="OIDC versus OAuth, and supported clients"}
+**OIDC** is not to be confused with **OAuth**. In the context of Matrix, OAuth is the protocol that Matrix clients use to authenticate with the _homeserver_. OIDC is the protocol that the _homeserver_ uses to communicate with the _identity provider_. Continuwuity supports OAuth by default, alongside the legacy **UIAA** authentication framework.
+
+When OIDC is configured, Continuwuity will disable its support for UIAA. **Only clients that support OAuth**, such as

@@ -0,0 +17,4 @@
+```sh
+# Here, `c10y` is the client ID that kanidm will use, and `Continuwuity` is the display name.
+# Other identity providers may generate a client ID for you.
+# Use the domain that Continuwuity is actually running on, even if you've configured delegation.

@@ -0,0 +10,4 @@
+when you try to log in after configuring OIDC, it likely does not support OAuth. This is an issue with your client, not
+Continuwuity, and should be reported to your client's developers.
+:::
+

@@ -0,0 +53,4 @@
+client_secret = "d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr"
+```
+
+Finally, restart Continuwuity, and log out and back in again. Your client should prompt you to continue in your web browser and open a webpage with the Continuwuity logo that allows you to continue in your identity provider. Once you log in successfully, you will be prompted to choose a user ID -- to link your existing account, enter its user ID, and then your old password when prompted.

@@ -0,0 +58,4 @@
+
+To enable full discovery, you will need to reverse proxy these paths from the base domain back to Continuwuity.
+
+:::warning