Gitea is a community managed lightweight code hosting solution written in Go. It is published under the MIT license.

It can be configured to authenticate users with OpenID Connect.



Make sure you have already enabled OpenID Connect on your LemonLDAP::NG server

Make sure you have generated a set of signing keys in OpenID Connect Service » Security » Keys

You also need to set a Signing key ID to a non-empty value of your choice.

Then, add a Relying Party with the following configuration:

  • Options » Basic » Client ID : choose a client ID, such as gitea

  • Options » Basic » Client Secret : choose a client secret, such as xxxx

  • Options » Basic » Allowed redirection address :

  • Options » ID Token Signature Algorithm : RS256

  • No Exported Attributes needed


The redirection address is built like this: <Gitea service URL> /user/oauth2/ <Name of the OIDC authentication source in Gitea> /callback


Go in administration panel and create a new authentication source:


Configure settings:

  • Authentication name: set here the value used for the redirection address

  • OAuth2 Provider: set OpenID Connect

  • Client ID: the Client ID configured on LL::NG side

  • Client Secret: the Client Secret configured on LL::NG side

  • OpenID Connect Auto Discovery URL: use the default OIDC configuration URL of your LL::NG server

  • Enable the authentication source


In Gitea login screen, a new OpenID logo appears at the bottom. Click on it to authenticate.

At first connection, the user must associate his account to an existing one (local or LDAP). The assocation is then remembered for further connections.