Custom OIDC

Use this for any OIDC issuer that does not have a dedicated form. You provide the issuer URL, an audience, and usually a subject. Without a subject, every caller that issuer signs tokens for is trusted.

When more than one provider is installed and you route a saved policy to a form with the matches<Name>Policy helpers, check Custom last. matchesCustomPolicy accepts almost any policy, so it would shadow the dedicated forms.

Docs and discovery


Discovery	`<issuer>/.well-known/openid-configuration`

You can paste a discovery URL. The /.well-known/openid-configuration suffix is stripped.

Token


Issuer	Any `https` URL with no query or fragment
Audience	The audience the caller requests. Use a value unique to your app.
Subject	Optional. The issuer's primary identifier for the caller.

Fields

Field	Claim	Required	Validation
Issuer	`iss`	Yes	`https://` URL with no query or fragment.
Audience	`aud`	Yes	The audience the caller requests.
Subject	`sub`	No	The issuer's primary identifier for the caller.
Additional claims	other	No	Cannot reuse `aud` or `sub`.

Example policy

{
  issuer: "https://issuer.example.com",
  claims: {
    aud: ["https://app.example.com"],
    sub: ["workload-1"],
    environment: ["production", "staging"],
  },
}

Add a field

Edit components/oidc/provider-custom.tsx after install. For a one-off claim, use Additional claims. For its own input, add it to Fields (or schema), DEFAULTS, compile, parse, FIRST_CLASS_CLAIMS, and the form.

See Add a field.