OIDC Provider Examples

OIDC Provider Examples

Always copy the exact issuer from the provider discovery document. Nutify does not contain provider-specific protocol behavior; these examples only map current provider terminology to Nutify fields.

Authentik

1. Open the Admin interface.
2. Go to Applications -> Applications -> New Provider.
3. Select OAuth2/OIDC.
4. Use a confidential client and add Nutify's exact callback URL.
5. Include openid, profile, and email scope mappings. Authentik's profile scope normally includes group membership.

The default per-provider issuer is:

https://authentik.example.com/application/o/<application-slug>/

Use the exact issuer shown by discovery, including its trailing slash. See the official Authentik OAuth2/OIDC provider documentation.

Authentik 2026.8+ can advertise Dynamic Client Registration. It requires an access token with the provider-required DCR scope. See the official DCR guide.

Keycloak

1. Select the realm and open Clients -> Create client.
2. Set Client type to OpenID Connect.
3. Enable Client authentication for a confidential server-side client.
4. Enable Standard Flow (Authorization Code).
5. Add Nutify's exact callback under Valid Redirect URIs.
6. Add a protocol mapper that emits the required group values in groups.

Issuer format:

https://keycloak.example.com/realms/<realm>

Keycloak can advertise Dynamic Client Registration. The recommended method is an Initial Access Token with limited lifetime and creation count. See the official Keycloak client registration guide and Server Administration Guide.

Microsoft Entra ID

1. Open Microsoft Entra ID -> App registrations -> New registration.
2. Add Nutify's callback as a Web redirect URI.
3. Copy the Application (client) ID and create a client secret.
4. Configure a groups claim or a custom claim consumed by Nutify.
5. Enter the emitted group object IDs in Nutify's group fields when using the standard Entra groups claim.

Use a tenant-specific v2 issuer:

https://login.microsoftonline.com/<tenant-id>/v2.0

Tenant-specific issuers are recommended because Nutify validates issuer values exactly. Entra can omit groups when membership exceeds its token limit; restrict emitted groups to those assigned to the application. See Microsoft's OIDC protocol guide, redirect URI guide, and group claims guide.