Provider guides

1. In the Google Cloud console, APIs & Services › Credentials, create an OAuth client ID of type Web application, and add the redirect URI (https://ronne.example.com/api/auth/sso/callback/<id>) under Authorized redirect URIs.
2. Set the OAuth consent screen to Internal, so only your Workspace can use it.
3. Bring back the client ID and the client secret. The issuer is https://accounts.google.com.
4. List your Workspace's domain under Who may sign in to create accounts on first sign-in.

Google doesn't put groups in its ID token, so group mappings can't be used with it.

Ronne reads sub, email, email_verified (it must be true), name, and the groups claim if you map groups. Test sign-in shows what arrived. The usual mistakes are under Adding a provider.

1. In the Entra admin center, App registrations › New registration, single tenant, with the redirect URI (https://ronne.example.com/api/auth/sso/callback/<id>) as a Web platform URI. Then Certificates & secrets › New client secret.
2. Bring back the Directory (tenant) ID (the preset makes the issuer, https://login.microsoftonline.com/<tenant>/v2.0), the Application (client) ID and the secret's Value (not its ID).
3. Token configuration › Add optional claim › ID: email and xms_edov. Entra never sends email_verified; for this preset Ronne accepts xms_edov (the email's domain is verified in your tenant) instead. Without it, sign-ins are refused.
4. Groups (optional): Token configuration › Add groups claim › Security groups. Entra sends group object IDs: map those. Past 200 groups the claim is left out, so assign only the groups Ronne maps to the application.

Ronne reads sub, email, email_verified (it must be true), name, and the groups claim if you map groups. Test sign-in shows what arrived. The usual mistakes are under Adding a provider.

1. Applications › Create App Integration › OIDC, Web Application, with the redirect URI (https://ronne.example.com/api/auth/sso/callback/<id>) as a sign-in redirect URI. Assign the people or groups who may use Ronne.
2. Bring back the client ID and client secret from the application's General tab. The issuer is your Okta domain, https://<your-org>.okta.com (the org authorization server).
3. Groups (optional): on the application's Sign On tab, set the groups claim: name groups, filter Matches regex .* (or only the groups Ronne maps). Add the groups scope.

Ronne reads sub, email, email_verified (it must be true), name, and the groups claim if you map groups. Test sign-in shows what arrived. The usual mistakes are under Adding a provider.

1. In the realm, Clients › Create client: OpenID Connect, Client authentication on, Standard flow only, and the redirect URI (https://ronne.example.com/api/auth/sso/callback/<id>) under Valid redirect URIs.
2. Bring back the client ID, and the client secret from the client's Credentials tab. The issuer is the realm's address, https://<host>/realms/<realm>. A Keycloak on a private address works: only root can type an issuer.
3. Groups (optional): Client scopes › the client's dedicated scope › Add mapper › Group Membership, token claim name groups, Full group path off.

Ronne reads sub, email, email_verified (it must be true), name, and the groups claim if you map groups. Test sign-in shows what arrived. The usual mistakes are under Adding a provider.

1. Applications › Providers › Create › OAuth2/OpenID Provider, confidential, with the redirect URI (https://ronne.example.com/api/auth/sso/callback/<id>) as a strict redirect URI. Then an application using it; its slug is in the issuer.
2. Bring back the client ID and client secret from the provider's page. The issuer is https://<host>/application/o/<slug>/, with its trailing slash.
3. Groups: the profile scope already sends them (the group names) in the groups claim.

Ronne reads sub, email, email_verified (it must be true), name, and the groups claim if you map groups. Test sign-in shows what arrived. The usual mistakes are under Adding a provider.

1. Applications › Create Application › Regular Web Application, and the redirect URI (https://ronne.example.com/api/auth/sso/callback/<id>) under Allowed Callback URLs.
2. Bring back the domain (the issuer is https://<domain>/, with its trailing slash), the client ID and the client secret from the application's Settings tab.
3. Groups (optional): Auth0 has no groups claim of its own. Add a post-login Action that sets the custom claim https://ronne.ai/groups on the ID token (from roles or app metadata); the preset reads that claim.

Ronne reads sub, email, email_verified (it must be true), name, and the groups claim if you map groups. Test sign-in shows what arrived. The usual mistakes are under Adding a provider.

1. Register a confidential web application using the authorization code flow with PKCE, and the redirect URI (https://ronne.example.com/api/auth/sso/callback/<id>) exactly as shown.
2. Bring back the issuer (the address whose /.well-known/openid-configuration the provider publishes, exactly as that document's issuer says it), the client ID and the client secret. It must be https://.
3. Groups (optional): the claim that lists them, usually groups.

Ronne reads sub, email, email_verified (it must be true), name, and the groups claim if you map groups. Test sign-in shows what arrived. The usual mistakes are under Adding a provider.