Identity providers (OIDC)
Register an OIDC application in your identity provider and bring the resulting values back to your deployment.
Audience: IT (the enabler)
The platform signs users in using OIDC. During deployment you point the application at an OIDC application you create in your identity provider, and supply a few values. These guides are shared: reference the one for your provider from your deployment-target guide.
What the deployment needs
Whichever provider you use, you create an OIDC application there and bring back:
- Discovery URL. Your provider's OIDC issuer, the
.well-known/openid-configurationbase. - Client ID and Client Secret for the OIDC application.
- Callback URL. Your deployment's sign-in callback, registered in the provider.
- Scopes. Typically
openid,profile, andemail.
URLs to register
Register all four against your deployment's hostname:
| Setting | Value |
|---|---|
| Callback URL | https://<YOUR_HOSTNAME>/api/v1/auth/callback |
| Logout URL | https://<YOUR_HOSTNAME> |
| Application login URI | https://<YOUR_HOSTNAME>/login |
| Allowed web origin | https://<YOUR_HOSTNAME> |
Choose your provider
These guides cover registering the application in your identity provider. For wiring the values into the deployment, mapping provider groups to workspace roles, and troubleshooting sign-in, see Single sign-on and identity.