---
title: "OpenID Connect (OIDC)"
url: "https://developer.tesma.com/integrations/integrations-oidc"
image: "https://developer.tesma.com/_og/d/c_Ocean.takumi,title_OpenID+Connect+(OIDC),props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiM0Mjg1ZjQifX19,p_Ii9pbnRlZ3JhdGlvbnMvaW50ZWdyYXRpb25zLW9pZGMi,s_0V_GRVO4XhFajq0c.png"
---

# OIDC

# Connect to your identity provider using OpenId Connect

OpenId Connect is a modern authentication protocol supporting various scenarios including Web and Mobile.

If your identity provider supports authentication via OpenId Connect (OIDC) then you're ready to provide a seamless user authentication for all CHG-MERIDIAN applications.

## [Configuration](#configuration)

### [CHG IdentityProvider](#chg-identityprovider)

To start integrating your identity provider you need following information from CHG IdentityProvider

-   Login redirect URI  
    _The location where authentication response is sent to._
-   Logout redirect URL (optional)\*  
    The location where a request is sent to clear the user's session data. This is required for single sign-out to work correctly.

### [Your IdentityProvider](#your-identityprovider)

Following information is required to integrate your identity provider

-   Domain name  
    _The domain part of the user's email address in order to associate the user names with your identity provider._
-   Authority  
    _URL to your identity provider._
-   Client Id  
    _Unique identifier_
-   Client secret (only required if your identity provider not support PKCE)  
    _Secret key used to authenticate the client (CHG IdentityProvider)._
-   Additional scopes  
    _Additional scopes might be required for additional user attributes_

### [Additional attributes](#additional-attributes)

-   `sub` _required_  
    Contains the unique identifier for a user in the federated login provider. It is used to link CHG-MERIDIAN specific identity to the external IdentityProvider.  
    Accepted alternatives:
    -   `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier`
-   `email` _required_  
    Contains the email address of the user.  
    Accepted alternatives:
    -   `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`
    -   `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier` only if it contains a valid email
-   `preferred_username`  
    Contains the users prefered username. Fallback is the users email address if none is provided.  
    Accepted alternatives:
    -   `name`
    -   `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`
-   `given_name`  
    Contains the users given name.  
    Accepted alternatives:
    -   `FirstName`
    -   `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`
-   `family_name`  
    Contains the users family name.  
    Accepted alternatives:
    -   `LastName`
    -   `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`
-   `nickname`  
    Can be used as fallback for the name that is displayed for the user. It's only used if the name claim is empty and no first and last name can be found.
-   `generic other attributes`  
    If the external identity provider sends other attributes than the ones mentioned above the CHG IdentityProvider will forward them to authenticated client applications but will not store them. Please keep those attributes to a minimum to avoid hitting limits of the used protocols such as header sizes or similar. Also this avoids distributing the users information to multiple systems unnecessarily.