Provider contract
Requirements for connecting an identity provider to Zero Trust.
Protocols
| Provider | Identity source |
|---|---|
OpenID Connect at https://accounts.google.com | |
| GitHub | OAuth with a numeric user ID and primary verified email |
| OpenID Connect | Discovery from your configured HTTPS issuer |
| OAuth 2.0 | Your configured authorization, token, and identity endpoints |
OAuth flows require authorization codes and Proof Key for Code Exchange (PKCE) with S256. A custom OAuth provider must support these requirements.
For custom OAuth, token authentication supports client_secret_basic (default) or client_secret_post. OpenID Connect discovers the supported method. You can request additional scopes where needed.
Identity response
A custom OAuth identity endpoint receives the exchanged bearer token. It must return a stable sub value that identifies the account:
{
"sub": "immutable-user-42",
"email": "admin@example.com",
"email_verified": true,
"name": "Application administrator"
}Email policies require the boolean email_verified: true. The name is optional. Use the immutable subject for account mapping; a display name or changeable username is unsuitable.
Providers are shared within one account. Register callbacks for every application hostname that uses the provider.
Callbacks
Register the exact callback displayed in the provider editor for each application hostname:
https://APPLICATION-HOST/_loclix/access/callback/PROVIDER-IDSign-in transactions expire after five minutes and require the browser transaction cookie. Starting another sign-in on the same hostname replaces the previous transaction.
Endpoint requirements
Provider endpoints must use HTTPS and public IP addresses. Private, loopback, reserved, and metadata addresses are rejected, as are HTTP redirects.
Each website permits 16 concurrent exchanges and 120 authentication steps per client IP per minute.
Credential changes
A blank secret retains the saved value only while the provider identity, client ID, and credential endpoints remain unchanged. Supply a new secret when changing any of those values.
Provider setup guides
Follow Identity providers to add a provider in Loclix.