Identity providers (OIDC)
Register an OIDC application in your identity provider and bring the resulting values back to your deployment.
Audience: IT (the enabler)
The platform signs users in using OIDC. During deployment you point the application at an OIDC application you create in your identity provider, and supply a few values. These guides are shared: reference the one for your provider from your deployment-target guide.
What the deployment needs
Whichever provider you use, you create an OIDC application there and bring back:
- Discovery URL. The full
.well-known/openid-configurationURL your provider displays; the bare issuer URL it is served under works too. - Client ID and Client Secret for the OIDC application.
- Callback URL. Your deployment's sign-in callback, registered in the provider.
- Scopes. Typically
openid,profile, andemail, plus any scope your provider requires for group claims. From version 3.2.3, configure the requested scopes and groups claim name in Users → Sign-in → Details after deployment. - Client authentication. The platform sends the client secret in the token request body (
client_secret_post). If your provider sets one method per application, select this one.
URLs to register
Register all four against your deployment's hostname:
| Setting | Value |
|---|---|
| Callback URL | https://<YOUR_HOSTNAME>/api/v1/auth/callback |
| Logout URL | https://<YOUR_HOSTNAME> |
| Application login URI | https://<YOUR_HOSTNAME>/login |
| Allowed web origin | https://<YOUR_HOSTNAME> |
Choose your provider
These guides cover registering the application in your identity provider. For wiring the connection into the deployment, assigning group roles in the UI, and recovering from a broken configuration, see Single sign-on and identity.