diff --git a/docs/docs/guides/integrate/identity-providers/generic-oidc.mdx b/docs/docs/guides/integrate/identity-providers/generic-oidc.mdx new file mode 100644 index 000000000..4aafef42f --- /dev/null +++ b/docs/docs/guides/integrate/identity-providers/generic-oidc.mdx @@ -0,0 +1,68 @@ +--- +title: Configure a Generic OIDC Identity Provider in ZITADEL +sidebar_label: Generic OIDC +id: generic-oidc +--- + +import GeneralConfigDescription from './_general_config_description.mdx'; +import Intro from './_intro.mdx'; +import CustomLoginPolicy from './_custom_login_policy.mdx'; +import IDPsOverview from './_idps_overview.mdx'; +import Activate from './_activate.mdx'; +import PrefillAction from './_prefill_action.mdx'; +import TestSetup from './_test_setup.mdx'; + + + +## Open the Generic OIDC Provider Template + + + +Click on the ZITADEL Callback URL to copy it to your clipboard. +You will have to paste this URL in your external OIDC provider's application configuration later. + +![Generic OIDC Provider](/img/guides/zitadel_generic_oidc_create_provider.png) + +## OIDC Provider Configuration + +### Register a new client/application + +1. Log in to your external OIDC Provider's dashboard or management console. +2. Navigate to the applications, clients, or integrations section (name may vary depending on your provider). +3. Create a new application or client and select "OIDC" or "OpenID Connect" as the type. +4. Set a name for the application. +5. [Paste the ZITADEL Callback URL you copied before](#open-the-generic-oidc-provider-template) into the "redirect URIs" or "sign-in redirect URIs" field. +6. Save or copy the generated **Client ID** and **Client Secret**. + +> The exact steps and terminology may vary for each provider. Refer to your provider's documentation if you don't see these options. + +## ZITADEL Configuration + +1. Return to [the Generic OIDC Provider template in ZITADEL](#open-the-generic-oidc-provider-template). +2. Enter the **Client ID** and **Client Secret** from your OIDC provider's application. +3. Give the provider a name (e.g., "My OIDC Provider"). This name will appear as a button on the ZITADEL login screen. +4. Enter the **Issuer URL** of your OIDC provider (e.g., `https://your-provider.example.com`). + +You can optionally configure the following settings. ZITADEL provides sensible defaults if you leave these unchanged. + +**Scopes**: The scopes define which information ZITADEL will request from the provider. `openid`, `profile`, and `email` are pre-filled. +This information is used to create or update the user within ZITADEL. +ZITADEL ensures that at least the `openid` scope is always sent. + +**Use PKCE**: If enabled, Proof Key for Code Exchange (PKCE) will be used to secure the authorization code flow in addition to the client secret. + + + +### Activate IdP + + + +![Activate the OIDC Provider](/img/guides/zitadel_activate_okta.png) + +### Ensure your Login Policy allows External IDPs + + + +## Test the setup + + diff --git a/docs/sidebars.js b/docs/sidebars.js index 452fb6730..e58462ee3 100644 --- a/docs/sidebars.js +++ b/docs/sidebars.js @@ -381,6 +381,7 @@ module.exports = { "guides/integrate/identity-providers/ldap", "guides/integrate/identity-providers/openldap", "guides/integrate/identity-providers/okta-oidc", + "guides/integrate/identity-providers/generic-oidc", "guides/integrate/identity-providers/okta-saml", "guides/integrate/identity-providers/keycloak", "guides/integrate/identity-providers/linkedin-oauth", diff --git a/docs/static/img/guides/zitadel_generic_oidc_create_provider.png b/docs/static/img/guides/zitadel_generic_oidc_create_provider.png index 4ca8b9a55..24ba74298 100644 Binary files a/docs/static/img/guides/zitadel_generic_oidc_create_provider.png and b/docs/static/img/guides/zitadel_generic_oidc_create_provider.png differ