Rocket.Chat

This guide explains how to connect the team messaging Rocket.Chat to VaultysHub using a Custom OAuth provider, available in the Community edition (free). The connection uses the OpenID Connect authorization code flow.

Prerequisites

• Rocket.Chat 7.x or 8.x, served over HTTPS (for example https://chat.example.com)
• Administrator access to Rocket.Chat and VaultysHub

Configuration in VaultysHub

1. Applications → Add: name Rocket.Chat, URL https://chat.example.com/
2. Type OIDC, then:
   • Redirect URI: https://chat.example.com/_oauth/vaultyshub (the last segment is the name of the Custom OAuth provider, in lowercase)
   • Allowed Scope: openid, email, profile
   • Subject Identifier (sub): Email Address
3. Note the Client ID ([appid]) and the Client Secret, then assign the application to the relevant users.

Configuration in Rocket.Chat

Administration → Workspace → Settings → OAuth → Add a Custom OAuth, named VaultysHub, then:

Field	Value
Enable	yes
URL	https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]
Token Path	/token
Token Sent Via	Header (VaultysHub expects the secret in the Basic header)
Identity Token Sent Via	Header
Identity Path	/userinfo
Authorize Path	/auth
Scope	openid email profile
Id / Secret	those of the VaultysHub application
Login Style	Redirect
Button Text	VaultysHub
Key Field	email
Email field	email
Name field	name
Merge users	yes

The Username field can remain empty: Rocket.Chat asks for a username on first login, as an email address is not a valid one.

Deployment via environment variables

The same provider can be created at first startup with variables Accounts_OAuth_Custom_VaultysHub, …_url, …_token_path, …_identity_path, …_authorize_path, …_scope, …_id, …_secret, …_token_sent_via, …_key_field, etc. They are only used for creation: any subsequent modification is done in the administration.

Two-factor authentication via email

Rocket.Chat enables two-factor authentication via email by default and registers each new user. Without a configured mail server, users coming from VaultysHub remain stuck waiting for a code. Configure email sending, or disable Two Factor Authentication by Email (Settings → Accounts → Two Factor Authentication): strong authentication is already done by VaultysHub.

Test

The login page displays a VaultysHub button: validate with your VaultysID, choose a username on first login, you are in Rocket.Chat.

Troubleshooting

• “redirect_uri mismatch”: the provider name does not match the last segment of the URI (/_oauth/<name in lowercase>).
• “invalid_client”: Token Sent Via is not set to Header.
• Certificate error to VaultysHub: Rocket.Chat (Node.js) uses NODE_EXTRA_CA_CERTS for an internal certificate authority.

Resources

• Rocket.Chat Documentation — Custom OAuth