I submitted a pull request for these changes to the official docs, but in case there is an issue, this guide should hopefully help out the next person trying to install this. https://github.com/FreshRSS/FreshRSS/pull/5969

The main documentation page is here: https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect.html

At the bottom of this page, they have a step by step guide here: https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect-Authentik.html

the guide could benefit from a few clarifications:

  1. you must set two callback urls in Authentik:
https://freshrss.example.net/i/oidc
https://freshrss.example.net:443/i/oidc

yes the port number is needed. You may be able to use ONLY the url with port number, but you CAN’T use the url without the port even if you are using the standard HTTPS port (443.

  1. OIDC_CLIENT_CRYPTO_KEY is really just a random string, you can generate it from a randome password generator. Not sure if there is a max length or special character restriction

  2. OIDC_SCOPES should include email as well as authentik includes that by default with the oAuth provider:

OIDC_SCOPES: openid email profile

  1. Not sure how to setup OIDC into an existing installation because you get stuck in a loop. The last step after everything works, is to login to freshrss and under FreshRss - > Settings -> Authentication, you need to change the user to HTTP. But this setting is only available if you have OIDC enabled. But if you enable OIDC and try to login you have to login with a user that already has HTTP enabled. I got it to work because I was setting up a fresh install and so it brought me to the page to create the user, I made one with the same name as my oAuth admin user and then I was able to immediately set it to HTTP in the settings before logging out. Not sure how to get around this on an existing install

  2. for OIDC_REMOTE_USER_CLAIM: preferred_username, I’m not sure where the preferred_username actually comes from but setting it to preferred_username actually works in my authentik install.