Generic OIDC

Use this guide for any OpenID Connect (OIDC) compliant identity provider that doesn't have its own guide.

Requirements#

Your identity provider must support:

• OIDC Discovery (a .well-known/openid-configuration endpoint)
• The Authorization Code flow with PKCE
• The standard claims sub, email, given_name and family_name

Step 1: Register Vectis as an application#

1. Create a new OIDC or OAuth 2.0 application in your identity provider.
2. Configure it:
   • Application type: Web application
   • Redirect URI: https://<your Vectis address>/sso/callback
   • Post-logout redirect URI: https://<your Vectis address>/login
   • Scopes: openid, profile, email
   • Grant type: Authorization Code
3. Note the Client ID and Client Secret.

Step 2: Find your OIDC discovery endpoint#

Your identity provider should publish an OIDC discovery document at:

{issuer_url}/.well-known/openid-configuration

It must return a JSON document with:

• authorization_endpoint
• token_endpoint
• jwks_uri
• issuer

Step 3: Send the details to Vectis#

Send Vectis support:

• Issuer URL: your identity provider's issuer URL.
• Client ID and Client Secret from step 1.
• Scopes: openid profile email, plus groups if your identity provider supports it.
• Domain: your organisation's email domain.

Step 4: Configure group claims (optional)#

If your identity provider supports group claims, configure it to include a groups claim in the ID token. Vectis checks these claim names automatically:

• groups
• roles
• http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
• cognito:groups

Verification checklist#

• The OIDC discovery endpoint is reachable.
• The JWKS endpoint returns valid signing keys.
• The redirect URI is configured correctly.
• The required scopes are granted.
• The email claim is present in the ID token.
• Domain verification is complete.