Skip to content

OIDC SSO: private_key_jwt info update #10195

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 7, 2025
Merged

OIDC SSO: private_key_jwt info update #10195

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bde5f6e
Entra ID does not support the `private_key_jwt`
Karuna-Mendix Oct 7, 2025
2cfae50
info box
Karuna-Mendix Oct 7, 2025
8346ec0
small fix
Karuna-Mendix Oct 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions content/en/docs/marketplace/platform-supported-content/modules/oidc.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -337,6 +337,8 @@ In this case, the OIDC client is the app you are making.
* `private_key_jwt`: This method, introduced in version 4.1.0, uses asymmetric key cryptography (algorithm) for authentication. This is the best option for security. When you select the `private key` option, you can configure the following fields:
* **Key Pair Expiration Days**: (default `90`)
* **JWT ALG(Signing Algorithm)**: (default `RS256`)

{{% alert color="info" %}}`private_key_jwt` is not yet supported with Entra ID due to the specific way of Microsoft's implementation, which requires enhancements to the OIDC SSO module.{{% /alert %}}

Once you **Save** the configuration, a key pair is automatically generated. Before you set up the private key authentication in your Mendix App, complete the JWKS configuration at your IdP. Check the documentation of your IdP for details. If you are using Okta, you can refer to the [Configuring JWKS at Your IdP (Okta)](#jwks-okta) section.

Expand Down