Skip to content
broch
get started →

Generic OIDC

Use this for any OIDC provider without its own guide. For Auth0, Entra ID or Okta, follow their guides instead.

In Your IdP

Section titled “In Your IdP”

Create an application registration of type Web Application (or the equivalent: Regular Web App, confidential client, server-side app) with:

  • Redirect URI: https://broch.{your-domain}/auth/callback (your Broch server URL)
  • Grant type: Authorization Code
  • Token endpoint authentication: Client secret (not PKCE-only)
  • Scopes: openid, profile, email, offline_access

Your IdP must serve an OIDC discovery document at {issuer}/.well-known/openid-configuration. The access token must include an email claim and, for admin access, a roles or groups claim containing one of your admin roles.

In Broch

Section titled “In Broch”

Enter the issuer URL, client ID, secret and admin roles where your deployment asks for them:

  • Azure Marketplace: choose generic OIDC on the form’s Identity provider tab.
  • Azure CLI: authProvider=Oidc and authAuthority=<issuer URL>.
  • AWS CloudFormation: choose Other OIDC provider in the launch chooser, then set AuthAuthority (OpenID Connect issuer URL) in the console.
  • Self-managed: set these environment variables:
Terminal window
# Generic OIDC — standard openid/profile/email scopes, no named-provider quirks
AUTHENTICATION__PROVIDER=Oidc


# Your IdP's issuer URL — the base that serves /.well-known/openid-configuration
AUTHENTICATION__AUTHORITY=<issuer-url>


AUTHENTICATION__CLIENTID=<your-client-id>
AUTHENTICATION__CLIENTSECRET=<your-client-secret>
AUTHENTICATION__ADMINROLES=<your-admin-role>


# Optional: request ADDITIONAL scopes (e.g. a resource/API scope your IdP needs).
# AUTHENTICATION__SCOPES is additive — Broch always requests openid, profile, email,
# and offline_access; anything you set here is appended, never substituted.
# AUTHENTICATION__SCOPES=api://your-resource/.default

Broch always requests openid, profile, email and offline_access: openid makes the IdP issue the ID token Broch authenticates on, and email is the user identifier. AUTHENTICATION__SCOPES only adds scopes on top.

At startup the server fetches {AUTHENTICATION__AUTHORITY}/.well-known/openid-configuration to discover the authorization, token and revocation endpoints. Setting AUTHENTICATION__AUTHORITY overrides any provider-specific authority.

PrivacyTerms