Menu AuthGuardHelp centre
Portuguêsauthguard.pt

Administrators · OpenID Connect

Register an OpenID Connect (OIDC) service

  • 2 min read
  • SaaS · Self-hosted
  • Video
Tutorial 07Applications: OpenID Connect, SAML and Microsoft 3652:39 · Narrated in Portuguese, with English captions.Transcript and details

The authentication service works as an OpenID Connect provider: your organization's applications send people to sign in and receive a signed ID token.

Before registering

Publish a policy rule that allows federation.authorize for the service; without it every sign-in ends in access_denied. See The application rule.

How do I register?

  1. Open «Manage» › «OIDC services» and choose «New service».
  2. Fill in:
FieldNotes
«Service identifier»The client_id: 2 to 128 characters, letters, digits and . _ ~ -
«Display name»The name people see on the sign-in page
«Type»«Confidential (server)», «Public (browser or app)» or Microsoft Entra (external authentication method)
«Token endpoint authentication»«Secret (Basic)», «Secret (form)» or «Private key (JWT)». Public services use PKCE without a secret
«ID token algorithm»RS256 (default) or ES256
«Redirect URIs»The exact addresses, one per line
«Scopes»openid always; email and profile if the service needs them
«Require PKCE»Mandatory for public services; recommended for all
«Refresh tokens (rotating)»Optional
«Post-logout redirect URIs»Optional; where the service may return after sign-out
  1. Choose «Save service» and confirm. «Service saved and recorded in the audit log.»

What do I give the service team?

  • The issuer https://<organization address> and the discovery document https://<organization address>/.well-known/openid-configuration (the console shows «Discovery document»).
  • The service identifier.
  • The secret, through a secure channel, for a confidential service. See OIDC service secrets.

Private key (JWT)

The service signs its own assertions and the server needs the service's public key. The console has no field for it: the key is loaded through the administration API. Ask your provider for help.

Custom domain

A service keeps the issuer of the address where it was configured. If you change the organization's primary address, existing services keep the old issuer.

Error codes in this article

Related articles

Article referencead-oidc-servicequote it to support to identify this article. Checked against the product at commit 5f6607a8.