> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-cloud/admin-essentials/integrations/auth/openid-connect-discovery/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Understand OpenID Connect Discovery

> How to configure OpenID Connect Discovery for authenticating with OAuth providers in Itential Platform 6 integrations.

Itential Platform supports OpenID Connect (OIDC) Discovery. OIDC Discovery facilitates connecting to an OpenID Provider by retrieving necessary configuration details, such as the authorization endpoint, token endpoint, and supported scopes.

For more information, see [OpenID Specifications](https://openid.net/developers/specs/).

## OIDC schema

In the `securitySchemes` object of an example integration model, the `OpenIDConnectScheme` must set the authentication `type` (`"openIdConnect"`) and a discovery endpoint that points to the OIDC identity provider's publicly available URL (`openIdConnectUrl`).

In the example schema, the public endpoint issued by the Microsoft identity platform is shown.

```json
{
  ...
  "components": {
    "securitySchemes": {
      "OpenIDConnectScheme": {
        "type": "openIdConnect",
        "openIdConnectUrl": "https://login.microsoftonline.com/common/.well-known/openid-configuration"
      }
    }
  }
}
```

Itential Platform does not support identifying end-users via OIDC. Users must log in to Itential Platform with their credentials. OIDC support in Itential Platform integrations is designed for authenticating and authorizing users with a given OAuth provider for access tokens to the relevant service.

## OIDC discovery

After creating an integration instance, Itential Platform reaches out to the discovery endpoint (`openIdConnectUrl`) and auto-populates the instance with those values. Any of these retrieved values may be overridden after instance creation; however, Itential recommends that you keep most of these values the same.

![](/_fern-img/a48c9bdb78b162dafda632d70ec82fa55e93bea07611f4e28d43580301b2ba96.webp)

If you see an item with `Option 1` and `Option 2`, they correspond to a variable that was null at the discovery endpoint. `Option 2` is null and `Option 1` allows for any string input.

## OIDC authorization code grant flow

Itential supports **Authorization Code Grant Flow** (auth code flow) for OIDC. The specifics are the same as summarized in the auth code flow for OAuth2 documented in "Integration Model - OAuth2 Authentication/Authorization"; however, there are a few variable name differences:

* `tokenUrl` and `token_url` becomes `token_endpoint`
* `authorizationUrl` becomes `authorization_endpoint`
* `scopes` object is enumerated by the `scopes_supported` array, without descriptions

Token requests for OIDC-compliant services must request the `openid` scope.

> How to configure OpenID Connect Discovery for authenticating with OAuth providers in Itential Platform 6 integrations.