Skip to main content

OpenID Connect (OIDC)

The OIDC login provider uses the OpenID Connect (OIDC) authorization code flow to authenticate a user. All OIDC-compliant identity providers (IdP) are supported, this includes Keycloak, Microsoft Azure (Entra ID), Google.

Redirect URL​

The redirect URL is where your identity provider sends an authorization code after authentication. It is a critical security feature that ensures that authorization codes are only sent to the intended recipient. For Studo Flow this needs to be set to:

https://<your-flow-domain>/oidc/callback

PKCE (Proof Key for Code Exchange)​

Although PKCE was originally introduced for public clients (mobile/SPA apps that cannot keep a client secret), the OAuth 2.0 Security Best Current Practice (RFC 9700) now recommends it for all clients, including confidential ones like Studo Flow. The upcoming OAuth 2.1 standard is expected to make PKCE mandatory across the board.

Studo Flow supports PKCE (RFC 7636) as an optional security enhancement for the authorization code flow. PKCE protects against authorization code interception attacks. It can be enabled via the enablePkce configuration key on the OIDC login provider.

note

PKCE requires your IdP to support it. Most modern IdPs (Keycloak 8+, Entra ID, Google) do. Enable it only after confirming support — mismatched PKCE configuration will break logins.

Backchannel logout​

If the OIDC provider supports backchannel logout, Studo Flow also supports it. The IdP must be configured to send backchannel logout requests to the Studo Flow backchannel logout endpoint:

https://<your-flow-domain>/oidc/backChannelLogout

Setup Flow to use your OIDC client​

Requirements​

You have set up a new OIDC client on your Identity Provider of choice. You will need the following configuration values:

  • OIDC client ID
  • OIDC client secret
  • OIDC metadata document url

Configuration​

Go to your Flow server's web UI, and log in as an admin user.
In case of the hosted option, this configuration has to be done by Studo.

  1. Go to System Configuration and click Configure login providers in the toolbar.
  2. Scroll down to OidcLoginProvider, set enable to "true" and click Save configuration.
  3. Set clientId to your client's id.
  4. Set clientSecret to your client's secret.
  5. Set openIdConfigUrl to your OpenID Endpoint Configuration URL (.well-known/openid-configuration).
  6. Optional: Set enablePkce to "true" if PKCE is supported by your provider.

Getting the user IDs right​

Flow gets all its users from its importers. The userId of these users must either match

  • the subject ("sub" field in the userinfo response)
  • the username ("preferred_username" field in the userinfo response)

Configure the userIdField according to your needs.

Limitations​

All users who log in via the OIDC login provider must already exist in the Studo Flow database (created by an importer). Currently, it's not possible to create a user "on-demand" when logging in. If this is a requirement contact us.

Guides​

Every CAMPUSonline deployment has a Keycloak instance.