Register the callback
Select OIDC in New identity provider. Copy the OIDC redirect URL from Service provider values and add it to the application’s allowed callback or redirect URLs.Create the provider
1
Choose OIDC
Open Settings > Single sign-on > New identity provider, then select OIDC.
2
Name the provider
Enter Provider name. You cannot rename it later.
3
Enter client registration
Enter Client ID and Client secret from the approved identity-provider application.
4
Configure the issuer
Enter Issuer URL. Leave Discover endpoints from issuer on when the provider publishes standard discovery metadata.
5
Map claims
Enter Email claim and Username claim as issued in the ID token.
6
Create and test
Review Enabled for sign-in, select Create, assign a pilot user, and test the normal K16 sign-in flow.
Configure endpoints manually
Turn off Discover endpoints from issuer only when your provider cannot publish usable discovery metadata. You must then enter:- Authorize URL
- Token URL
- Attributes URL
- JWKS URI
Rotate the client secret
After save, K16 does not display the full client secret. When you edit the provider, leave the protected placeholder unchanged unless you intend to rotate the secret.- Create the replacement secret in the identity provider.
- Enter it in Client secret.
- Select Save changes.
- Test a pilot sign-in.
- Retire the previous secret according to your identity-provider policy.