## Authentication Settings

Configure authentication methods for your Booklore instance. Internal authentication is always enabled, and you can optionally enable OIDC for external authentication providers.

### Internal Authentication

Internal authentication is always enabled and cannot be disabled. However, OIDC can be used alongside internal authentication if OIDC is enabled.

Internal Authentication Enabled

### OIDC Authentication (Experimental)

Configure external authentication providers using OpenID Connect (OIDC) protocol for seamless single sign-on integration.

OIDC Enabled @if (!isOidcFormComplete()) {
(Fill all required fields to enable)
}

#### OIDC Provider Settings

Provider Name
Client ID
Scope
Required scopes for OIDC login and token exchange. Must be supported and advertised in the provider's discovery metadata.
Issuer URI
Username Claim
Email Claim
Display Name Claim
These claims are used by Booklore to provision new OIDC users with their name, username, and email. Ensure they match the claims provided by your OIDC provider.
@if (oidcEnabled) {

#### OIDC User Provisioning

Automatic user provisioning
Enabling auto-provisioning ensures that new users are automatically created with the selected default permissions. If turned off, users must be manually created in Booklore before they can log in.
@if (autoUserProvisioningEnabled) {

##### Default permissions for auto-provisioned users

Read Books
@for (perm of availablePermissions; track perm) {
{{ perm.label }}
}

##### Default libraries for auto-provisioned users

}
}