Add an OIDC Provider
Use the Add Provider action to connect an OpenID Connect identity provider such as Microsoft Entra ID, Okta, Google Workspace, or Keycloak, so users can sign in to Qualytics with their corporate identity.
Permissions
Only users with the Admin role can manage sign-in providers. See the Permissions page for details.
Fields
General
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | Display Name | Required. The name shown to users on the sign-in page. |
Connection
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | Client ID | Required. The client identifier from your identity provider's application registration. |
| 2 | Client Secret | The client secret from your identity provider. Required for the client secret authentication methods. Stored securely and never displayed again; enter it again only to replace it. |
| 3 | Scopes | The OAuth scopes requested from the provider (e.g. openid, email, profile). Type a scope and press Enter to add each one. Add offline_access to keep users signed in for their full session; see the tip below. |
| 4 | Token Auth Method | How Qualytics authenticates to the token endpoint: Client Secret (POST) (default) or Client Secret (Basic). The list also shows Private Key JWT and None (Public Client), which are greyed out because the platform does not support them. |
| 5 | Token Lifetime | Required. In minutes (default 30). It applies only as a fallback for the session length, when Session Duration is left empty, so Session Duration is what governs how long sessions last in practice. |
| 6 | Back-channel logout | Lets the identity provider sign users out of Qualytics through back-channel logout requests. When enabled, register the displayed Back-channel Logout URI at the identity provider. |
| 7 | Session Duration | Required. How long a Qualytics session remains valid after sign-in, in minutes, between 5 and 1440 (default 480, which is 8 hours). |
Keep users signed in with the offline_access scope
Without offline_access, the access the identity provider grants at sign-in typically expires after about an hour, and the session ends once that access can no longer be renewed, even for someone actively working. Adding the scope lets Qualytics renew that access silently, so sessions last their full configured duration. The scope is set once on the provider and benefits every user of it, starting at each user's next sign-in.
For the scope to take effect, your identity provider's application registration must permit it, and the provider's UserInfo Endpoint must be filled in.
Google Workspace grants offline access through its own mechanism instead of the standard scope, so the Test flags offline_access with a warning on Google providers. Add the scope anyway: Qualytics converts the request to the form Google expects, and the warning does not block saving. See Staying Signed In.
Endpoints
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | Discovery URL | Your identity provider's OpenID Connect discovery endpoint (e.g. https://example.com/.well-known/openid-configuration). Providing it fills in the fields below automatically. |
| 2 | Authorization Endpoint | Required. URL where users are redirected to authenticate. |
| 3 | Token Endpoint | Required. URL used to exchange the authorization code for tokens. |
| 4 | UserInfo Endpoint | URL used to fetch the authenticated user profile. Also the endpoint Qualytics checks an active session against, so leaving it empty stops sessions from being renewed. |
| 5 | JWKS URI | URL used to fetch the signing keys for token verification. |
| 6 | Issuer | The expected issuer value in ID tokens. |
Note
Identity provider URLs must use HTTPS.
Claim Mapping
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | OIDC Claim Mapping | Maps Qualytics user fields to the claim names your identity provider emits. The supported fields are id, email, name, and picture. Leave the mapping empty to use the provider defaults. |
Access Restriction
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | Groups Claim | The identity provider claim containing group memberships. Hidden on Google Workspace providers, which get group membership from the Directory instead (see Google Workspace Groups below). |
| 2 | Allowed Groups | Only users in these groups can sign in. Leave empty to allow all users. |
| 3 | Allowed Email Domains | Only users with an email in these domains can sign in. Leave empty to allow all domains. |
| 4 | Require verified email | Refuses to link an identity to an existing account, or to create a new account for it, unless the provider reports the email as verified. Sign-ins by already-linked users are not affected. Off by default, because many providers do not report it. |
Provisioning and Linking
| REF. | FIELD | DESCRIPTION |
|---|---|---|
| 1 | Automatic user provisioning | Creates a Qualytics user after a successful sign-in when the identity is not linked to an account yet. On by default. |
| 2 | Cross-provider account linking | Allows an identity from this provider to request linking to an existing account with the same email. On by default. |
| 3 | Require administrator approval | Keeps newly proposed cross-provider links pending until an administrator approves them in Link approvals. Off by default, so links are created without review unless you turn it on. |
Info
For how provisioning, linking, and restrictions behave at sign-in, see How It Works.
Steps
Step 1: Click the Add Provider button in the Providers tab, or select Provider from the Add menu in the top right corner.
Step 2: The Add Provider modal appears.
Step 3: Select OpenID Connect as the provider type.
Step 4: Fill in the provider fields (see Fields above).
Step 5: Click the Test button and review the results.
Step 6: Click the Create button.
Step 7: A dialog displays the Redirect URI for the new provider. Copy it and register it in your identity provider's application configuration.
Step 8: Click the Done button. A success message appears and the provider is listed in the Providers tab.
Google Workspace Groups
When the provider's Issuer is Google (accounts.google.com), the form shows a Google Workspace Directory section, because Google's sign-in does not include group membership. On these providers the Groups Claim field is replaced by the toggle below, and Allowed Groups appears once the toggle is on:
Step 1: Enable Fetch Google Workspace groups to retrieve each user's groups from the Google Workspace Directory at sign-in.
Step 2: Create the provider. It stays disabled until the Directory access is authorized.
Step 3: Enable the Admin SDK API in Google Cloud, then click Authorize on the provider and complete the consent as a Google Workspace administrator. The grant gives Qualytics read-only access to Users and Groups; individual users are never asked for Directory access.
Step 4: The provider shows Administrator connected with the authorizing administrator's email. You can now enable the provider.
Tip
Use the Verify button on the provider to confirm the authorization is still valid, and Reauthorize if it needs to be renewed.
With the grant in place, the fetched groups drive the Allowed Groups restriction and, when group-based Team membership is enabled for your deployment, Team mapping. See How It Works.