Add an OAuth 2.0 Identity Provider

This guide explains how to register a generic OAuth 2.0 identity provider (IdP) in ThunderID. Use this type for OAuth 2.0 providers that do not implement OpenID Connect discovery. If the provider supports OIDC, use Add an OIDC Identity Provider instead.

Prerequisites

• ThunderID is running. See Get Started.
• You can sign in to the ThunderID Console.
• A client application registered in the external OAuth 2.0 provider with a Client ID and Client Secret, and permission to add the Redirect URI shown by the Console.
• The provider's authorization endpoint, token endpoint, and userinfo endpoint URLs.

Create the OAuth 2.0 Connection

1

Step 1: Add a Custom Connection

1. Sign in to the ThunderID Console.
2. Navigate to Connections.
3. Click the Add custom connection card.

2

Step 2: Choose the Connection Type

1. On the Connection type step, click OAuth 2.0 Provider.
2. Click Continue.

3

Step 3: Name the Connection

1. Enter a Connection name, or pick one of the suggested names.
2. Click Continue.

4

Step 4: Configure the Connection

The form shows a setup hint with the Redirect URI. Before creating the connection, copy it and register it as the callback URL with your provider.

Enter the following fields, then click Create connection:

Field	Required	Description
Client ID	Yes	The client ID issued by the OAuth 2.0 provider.
Client secret	Yes	The client secret issued by the OAuth 2.0 provider.
Authorization endpoint	Yes	The provider's authorization endpoint, used to start the sign-in flow.
Token endpoint	Yes	The provider's token endpoint, used to exchange the authorization code for tokens.
UserInfo endpoint	Yes	The provider's userinfo endpoint. ThunderID calls this endpoint to fetch the authenticated user's profile.

After creation, open the connection. Configure the following on its edit page:

Field	Description
Scopes	Space-separated OAuth scopes to request, beyond the provider's default.
Logout endpoint	The provider's logout endpoint, used to end the user session on logout.
Prompt	Optional prompt value forwarded to the provider's authorization request, for example select_account or consent.

To map this provider's claims to local user attributes, go to the Attribute Configuration tab. See Attribute Configuration for the mapping concepts, which apply the same way to OAuth 2.0 connections.

Next Steps

• Connect an IdP to an Application: Add this OAuth 2.0 IdP to an application's authentication flow.
• Manage Identity Providers: Update or delete identity providers.