Generic OIDC Provider

A checklist for connecting NeMo Helix to any OIDC-compliant identity provider not covered by the Azure AD page.

Prerequisites: Familiarity with OIDC Setup.

Provider Checklist

Verify your IdP meets these requirements:

• Supports OpenID Connect (not just OAuth2)
• Exposes a .well-known/openid-configuration discovery document
• Supports the device authorization grant (required for nemo auth login)
• Issues access tokens that NeMo Helix can validate
• Includes email (or equivalent claim) in the access token or introspection response
• If you use group-based role bindings, includes the claim selected by groups_claim in the access token or introspection response
• If you use API-scope restrictions, includes NeMo Helix API scopes such as platform:read and platform:write in the scope or scp claim of the access token or introspection response
• For signed tokens, uses RS256 or ES256 and provides JWKS for signature validation
• For opaque tokens, provides an introspection endpoint and any required client credentials

Configuration Template

auth:
  enabled: true
  oidc:
    enabled: true
    issuer: "<your-idp-issuer-url>"
    public_client:
      client_id: "<your-client-id>"
      default_scopes: "platform:read platform:write openid profile email offline_access"
      # scope_prefix: "api://<your-client-id>/"
    # Uncomment and adjust if your IdP uses non-standard claim names:
    # email_claim: "email"
    # subject_claim: "sub"
    # Set this to the claim that contains group or entitlement values
    # you will bind to NeMo Helix workspace roles.
    # groups_claim: "groups"

Keep short NeMo Helix API scope names in public_client.default_scopes. When the IdP expects api://<client-id>/platform:read, set public_client.scope_prefix to api://<client-id>/. Clients add that prefix to the API scopes they request, and discovery returns it on the interactive client. Omit the platform:* scopes when the login token should not restrict API access. Role bindings still apply.

For opaque access tokens, add introspect_opaque_tokens: true under auth.oidc. Set introspection_endpoint if discovery does not provide it. If the endpoint requires client authentication, set introspection_client_id and introspection_client_secret_env_var to the client ID and the name of the environment variable containing its secret.

Claim Mapping Reference

Related

• OIDC Setup — Full OIDC configuration guide.
• OIDC Setup — Claim mapping — JWT claims vs config defaults.
• Auth Configuration — Full config reference.