Can't enable OIDC

[Diagonet]

Describe the bug
Trying to enable OIDC I fill out the settings in the webui but when I try to save I get Error: OIDC is enabled but providerUrl, redirectUri, and clientId are required.. Those are all filled, even tried filling the OIDC info, saving THEN unchecking disable OIDC and still no go.

To Reproduce
Steps to reproduce the behavior:

1. Go to Admin Panel
2. Fill out OIDC info and uncheck Disable OIDC Login
3. Click Save Settings
4. See error

Expected behavior
I expected to enable OIDC as a login option.

Desktop (please complete the following information):

• OS: Ubuntu (Docker)
• Browser Vivaldi
• Version 7.6.3797.63

Additional context
Fresh install, first thing I did after getting the container up.

[error311]

Thank you @Diagonet for opening this. A recent update caused this issue for first save you needed to replace but wasn't visible. This is now resolved in v1.8.9.

[Diagonet]

Thanks for the quick fix, Im trying to get it working OIDC with authelia's guide but

{"time":"2025-11-08T03:46:24Z","level":"error","msg":"Authorization Response for Request with id '30856c3a-7a81-4583-8be3-bea86470ed6f' on client with id 'filerise' using policy 'admin_only' could not be created: The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. Clients must include a 'code_challenge' when performing the authorize code flow, but it is missing. The authorization server is configured in a way that enforces PKCE for all public client type clients and the 'filerise' client is using the public client type.","method":"GET","path":"/api/oidc/authorization","remote_ip":"redacted"}

I get this error. Also, this client doesn't use secrets? Normally I have to add the hash to authelia's config but here its saying to enable 'public' which doesnt allow that.

[error311]

Register the client as non-public and give it a secret.

Generate the secret + hash with Authelia’s CLI and put the plaintext secret in FileRise Admin (OIDC Client Secret), put the hash in Authelia’s config.

[Diagonet]

Will try that but then it asks for a token_endpoint_auth_method: would you know if its client_secret_basic or client_secret_post? I guess I can probably just test it, will try tomorrow.

[error311]

FileRise uses the Jumbojett PHP OIDC client, which defaults to client_secret_basic for token endpoint auth. If you want to use client_secret_post, Authelia supports it, and FileRise/Jumbojett can use it too.

[Diagonet]

Yeah, couldn't get OIDC working with Authelia no matter what I changed, keep getting the same error about 'code_challenge'

[error311]

@Diagonet

I’ve updated FileRise v1.8.11 to always send PKCE (S256) during the OIDC authorize request. That should satisfy Authelia’s requirement for public clients and also works fine with confidential clients.

If you’re still seeing the “code_challenge” error, double-check:
• Your Authelia client is either public: true + require_pkce: true or public: false with a secret.
• The redirect URI in Authelia exactly matches what you set in FileRise Admin (no extra slashes or params).
After reloading Authelia, try again and you should now see code_challenge and code_challenge_method=S256 on the /authorize URL.

[error311]

@Diagonet I reopened this. Could you confirm if v1.8.11 resolves your issue?

[Diagonet]

It seems to be fixed yeah, thanks. I don't really know how to but if you wanna submit a PR to Authelia's guide https://www.authelia.com/integration/openid-connect/clients/file-rise/
Here is what worked for me, for Authelia's config

      - client_id: 'filerise'
        client_name: 'FileRise'
        client_secret: "secret_digest"
        public: false
        authorization_policy: 'two_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://rise.example.com/api/auth/auth.php?oidc=callback'
        scopes:
          - 'openid'
          - 'email'
          - 'profile'
        response_modes:
          - 'form_post'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'