oidc

Any OpenID Connect provider: Okta, Auth0, Keycloak, GitLab, Zitadel and the rest. Endpoints and signing keys are discovered at issuer, and ID tokens are checked exactly as for enterprise SSO connections: signature against the issuer’s own keys, then issuer, audience, lifetime and nonce. Only identity scopes are requested; provider tokens are never stored.

let assert Ok(identity) =
  auth.with_provider(identity, oidc.new(
    id: "gitlab",
    name: "GitLab",
    issuer: "https://gitlab.com",
    client_id: gitlab_client_id,
    client_secret: gitlab_client_secret,
    authoritative_for: [],
  ))

Discovery happens when the first sign-in begins, and is cached for five minutes, so an unreachable provider fails that sign-in rather than startup.

Values

new

</>

pub fn new(
  id id: String,
  name name: String,
  issuer issuer: String,
  client_id client_id: String,
  client_secret client_secret: String,
  authoritative_for domains: List(String),
) -> provider.Provider

issuer is the exact iss the provider puts in its tokens, with no trailing slash unless it has one there too; discovery must return it.

authoritative_for lists the email domains this provider is the authority for, such as a company’s own domain on its own Keycloak. A verified address in one of them may create a new account; any other address must register by email first and then link, because a provider verifying an address once does not make it that address’s owner. Pass [] for a public provider where anyone can sign up.