> This page is for version Latest (default).
> For other versions, use one of these documentation indexes:
> - Latest (default): https://docs.nvidia.com/nemo-helix/latest/llms.txt
> - 0.8.0: https://docs.nvidia.com/nemo-helix/v0.8.0/llms.txt
> - 0.7.1: https://docs.nvidia.com/nemo-helix/v0.7.1/llms.txt
> - 0.7.0: https://docs.nvidia.com/nemo-helix/v0.7.0/llms.txt
> - 0.6.0: https://docs.nvidia.com/nemo-helix/v0.6.0/llms.txt
> - 0.5.1: https://docs.nvidia.com/nemo-helix/v0.5.1/llms.txt
> - 0.5.0: https://docs.nvidia.com/nemo-helix/v0.5.0/llms.txt
> - 0.4.0: https://docs.nvidia.com/nemo-helix/v0.4.0/llms.txt
> - 0.3.0: https://docs.nvidia.com/nemo-helix/v0.3.0/llms.txt
> - 0.2.0: https://docs.nvidia.com/nemo-helix/v0.2.0/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemo-helix/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemo-helix/_mcp/server.

# Generic OIDC Provider

A checklist for connecting NeMo Helix to any OIDC-compliant identity provider not covered by the [Azure AD](/documentation/access-control/authentication/providers/azure-ad-entra-id) page.

**Prerequisites**: Familiarity with [OIDC Setup](/documentation/access-control/authentication/oidc-setup).

## Provider Checklist

Verify your IdP meets these requirements:

* [ ] Supports **OpenID Connect** (not just OAuth2)
* [ ] Exposes a `.well-known/openid-configuration` discovery document
* [ ] Supports the **device authorization grant** (required for `nemo auth login`)
* [ ] Issues signed JWT bearer tokens, or signed ID tokens if you configure `bearer_token_source: "id_token"`
* [ ] Includes **email** (or equivalent claim) in the selected bearer token
* [ ] If you use group-based role bindings, includes group or entitlement values in a JWT claim that can be configured as `groups_claim`
* [ ] If you use API-scope restrictions during OIDC login, can expose and return NeMo Helix API scopes such as `platform:read` and `platform:write`
* [ ] Supports **JWKS** for token signature validation

## Configuration Template

```yaml
auth:
  enabled: true
  oidc:
    enabled: true
    issuer: "<your-idp-issuer-url>"
    client_id: "<your-client-id>"
    # Uncomment and adjust if your IdP uses non-standard claim names:
    # email_claim: "email"
    # subject_claim: "sub"
    # Set this to the claim that contains group or entitlement values
    # you will bind to NeMo Helix workspace roles.
    # groups_claim: "groups"
    default_scopes: "platform:read platform:write openid profile email offline_access"
```

Keep short NeMo Helix API scope names in `default_scopes`. If your IdP requires resource-qualified API scopes, such as `api://<app-client-id>/platform:read`, configure the deployment's `scope_prefix` so auth discovery can tell clients which prefix to apply. If you do not want OIDC login tokens to carry API-scope restrictions, omit the `platform:*` scopes; NeMo Helix still enforces role bindings.

## Claim Mapping Reference

| IdP              | Email Claim | Subject Claim | Groups Claim |
| ---------------- | ----------- | ------------- | ------------ |
| Azure AD         | `upn`       | `oid`         | `groups`     |
| Okta             | `email`     | `sub`         | `groups`     |
| Keycloak         | `email`     | `sub`         | `groups`     |
| Auth0            | `email`     | `sub`         | custom       |
| Google Workspace | `email`     | `sub`         | N/A          |
| Generic OIDC     | `email`     | `sub`         | `groups`     |

## Related

* [OIDC Setup](/documentation/access-control/authentication/oidc-setup) — Full OIDC configuration guide.
* [OIDC Setup — Claim mapping](/documentation/access-control/authentication/oidc-setup#claim-mapping) — JWT claims vs config defaults.
* [Auth Configuration](/documentation/access-control/deployment) — Full config reference.