> This page is for version 0.10.
> For other versions, use one of these documentation indexes:
> - Latest (default): https://docs.nvidia.com/nemo-helix/latest/llms.txt
> - 0.10: https://docs.nvidia.com/nemo-helix/v0.10/llms.txt
> - 0.9: https://docs.nvidia.com/nemo-helix/v0.9/llms.txt
> - 0.8: https://docs.nvidia.com/nemo-helix/v0.8/llms.txt
> - 0.7: https://docs.nvidia.com/nemo-helix/v0.7/llms.txt
> - 0.6: https://docs.nvidia.com/nemo-helix/v0.6/llms.txt
> - 0.5: https://docs.nvidia.com/nemo-helix/v0.5/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemo-helix/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemo-helix/_mcp/server.

# Generic OIDC Provider

A checklist for connecting NeMo Helix to any OIDC-compliant identity provider not covered by the [Azure AD](/nemo-helix/v0.10/documentation/access-control/authentication/providers/azure-ad-entra-id) page.

**Prerequisites**: Familiarity with [OIDC Setup](/nemo-helix/v0.10/documentation/access-control/authentication/oidc-setup).

## Provider Checklist

Verify your IdP meets these requirements:

* [ ] Supports **OpenID Connect** (not just OAuth2)
* [ ] Exposes a `.well-known/openid-configuration` discovery document
* [ ] Supports the **device authorization grant** (required for `nemo auth login`)
* [ ] Issues access tokens that NeMo Helix can validate
* [ ] Includes **email** (or equivalent claim) in the access token or introspection response
* [ ] If you use group-based role bindings, includes the claim selected by `groups_claim` in the access token or introspection response
* [ ] If you use API-scope restrictions, includes NeMo Helix API scopes such as `platform:read` and `platform:write` in the `scope` or `scp` claim of the access token or introspection response
* [ ] For signed tokens, uses `RS256` or `ES256` and provides **JWKS** for signature validation
* [ ] For opaque tokens, provides an introspection endpoint and any required client credentials

## Configuration Template

```yaml
auth:
  enabled: true
  oidc:
    enabled: true
    issuer: "<your-idp-issuer-url>"
    public_client:
      client_id: "<your-client-id>"
      default_scopes: "platform:read platform:write openid profile email offline_access"
      # scope_prefix: "api://<your-client-id>/"
    # Uncomment and adjust if your IdP uses non-standard claim names:
    # email_claim: "email"
    # subject_claim: "sub"
    # Set this to the claim that contains group or entitlement values
    # you will bind to NeMo Helix workspace roles.
    # groups_claim: "groups"
```

Keep short NeMo Helix API scope names in `public_client.default_scopes`. When the IdP expects `api://<client-id>/platform:read`, set `public_client.scope_prefix` to `api://<client-id>/`. Clients add that prefix to the API scopes they request, and discovery returns it on the interactive client. Omit the `platform:*` scopes when the login token should not restrict API access. Role bindings still apply.

For opaque access tokens, add `introspect_opaque_tokens: true` under `auth.oidc`. Set `introspection_endpoint` if discovery does not provide it. If the endpoint requires client authentication, set `introspection_client_id` and `introspection_client_secret_env_var` to the client ID and the name of the environment variable containing its secret.

## Claim Mapping Reference

| IdP              | Email Claim | Subject Claim | Groups Claim |
| ---------------- | ----------- | ------------- | ------------ |
| Azure AD         | `upn`       | `oid`         | `groups`     |
| Okta             | `email`     | `sub`         | `groups`     |
| Keycloak         | `email`     | `sub`         | `groups`     |
| Auth0            | `email`     | `sub`         | custom       |
| Google Workspace | `email`     | `sub`         | N/A          |
| Generic OIDC     | `email`     | `sub`         | `groups`     |

## Related

* [OIDC Setup](/nemo-helix/v0.10/documentation/access-control/authentication/oidc-setup) — Full OIDC configuration guide.
* [OIDC Setup — Claim mapping](/nemo-helix/v0.10/documentation/access-control/authentication/oidc-setup#claim-mapping) — JWT claims vs config defaults.
* [Auth Configuration](/nemo-helix/v0.10/documentation/access-control/deployment) — Full config reference.