Using OIDC Authentication With Authelia and LLDAP

[arkevorkhat]

This guide will go over how to configure AMP and Authelia to use OIDC to login.
Any text between angle brackets <example> is a placeholder.
Prerequisites:

• A working Authelia instance connected to LLDAP
• A working AMP instance
• An AMP Advanced or Enterprise license
• Access to the computer on which Authelia and AMP are running.

Step 1) Setting up your LDAP user
Inside LLDAP create a user in the group AMP_Super Admins.

Step 2) Setting up the Authelia client application
Configure Authelia as follows.
configuration.yml

identity_providers:
  oidc:
    clients:
      # ...
      - client_id: <a unique identifier> # I used cubecoders_amp
        client_name: Cubecoders AMP # optional
        client_secret: <secret> 
           # see https://www.authelia.com/integration/openid-connect/frequently-asked-questions/#how-do-i-generate-a-client-identifier-or-client-secret
           # This will be the secret digest generated when you follow the above directions.
           # make sure to note down the plaintext secret, you'll need it for the next step.
        public: false
        authorization_policy: 'one_factor' # OR 'two_factor' if you want to require 2FA to use AMP.
        redirect_uris:
          - <URL to your AMP instance> # this includes protocol (E.g. https://) and trailing slash.
        scopes:
          - 'openid' # required for all OIDC applications
          - profile # allows AMP to see the user's name and profile photo
          - groups # allows AMP to read the user's groups (required for roles to work)
          - email # allows AMP to read the user's email
        grant_types: 
          - authorization_code
        token_endpoint_auth_method: client_secret_post

Step 3) setting up AMP to use OIDC
OIDC settings can, in addition to the configuration file method described below, be configured in the web UI at Configuration → Security And Privacy → OIDC auth. Depending on how you installed AMP the configuration file may be in a different place. This guide will assume you are using Linux. (I use Arch BTW) ((had to include the meme))
/home/amp/AMPConfig.conf

# ...
################################
# Login
################################
Login.UseAuthServer=False
# Login.AuthServerURL - The URL for the ADS instance providing authentication when using UseAuthServer
Login.AuthServerURL=http://localhost:8080/
Login.UseLocal=False #Apparently can be True as well on 2.7.2.8, I left it False as I only want SSO users.
Login.MetricsServerHost=localhost
Login.MetricsServerPort=12820
# LDAP section omitted for brevity
Login.UseOIDC=True
Login.OIDCProviderFriendlyName=Authelia # This can be any name you want.
Login.OIDCClientID=<the client ID you set in step 2>
Login.OIDCClientSecret=<the plaintext secret you generated in step 2>
Login.OIDCAuthorizeScopes=["openid","profile","email","groups"]
Login.OIDCRedirectUri=<AMP URL>
Login.OIDCAuthorizeEndpoint=https://<Authelia URL>/api/oidc/authorization
Login.OIDCValidationEndpoint=https://<Authelia URL>/api/oidc/userinfo
Login.OIDCTokenEndpoint=https://<Authelia URL>/api/oidc/token
Login.OIDCUserInfoEndpoint=https://<Authelia URL>/api/oidc/userinfo
Login.OIDCLogoutEndpoint=https://<Authelia URL>/api/logout
Login.OIDCRevokeEndpoint=https://<Authelia URL>/api/oidc/revocation
Login.OIDCRoleNamePrefix=AMP_
Login.OIDCUsernameClaim=name
Login.OIDCNewUsersDisabledAtCreation=False
Login.OIDCIgnoreTLSFailure=False

Step 4) Profit
if you’ve configured everything correctly, you should now be able to log into AMP using Authelia.

Additional info:
If you want to use roles in AMP and assign them to OIDC users, create the role in AMP, then create a group in LLDAP named AMP_<group name>