OIDC single sign-on

Any OpenID Connect provider: Okta, Entra ID, Keycloak, Auth0, Google Workspace, Ping. Configured by issuer URL; endpoints come from discovery.

This provider fills the identity slot. Configure it in Settings → Providers, or during first-run setup.

Settings

Key	Field	Type	Required	Notes
issuer	Issuer URL	URL	Yes	Enter the issuer URL. BattleTest discovers its OpenID Connect endpoints automatically.
clientId	Client ID	text	Yes	—
clientSecret	Client secret	secret or reference	Yes	Paste the client secret to store it encrypted, or use an env:NAME or file:/path reference.
scopes	Scopes	text	No	We need openid and email. Add more only if your provider requires them. Default: openid email profile.
redirectUri	Redirect URI	URL	No	Derived from this instance’s web origin. Register this exact value with your provider.
allowLocalLogin	Keep password login enabled	yes / no	No	Turn off once SSO works. Leaving it on during rollout means a broken IdP does not lock everyone out. Default: true.

Note

One field is a secret (clientSecret). Pasted secrets are encrypted before storage. You can also supply a reference resolved when it is used. env:NAME reads a process environment variable; file:/run/secrets/name reads a mounted secret file.

What the connection test checks

Select Test connection to run a live test against the credentials you supplied. Saving validates and stores the configuration. Every check below is evaluated against the real service, not inferred from the configuration.

Check	Outcome
Discovery document reachable	Must pass
Authorization and token endpoints present	Must pass
Signing keys published	Must pass
Redirect URI matches this instance	Advisory

Adapter id: oidc-identity.