Generic OIDC Provider

A checklist for connecting NeMo Helix to any OIDC-compliant identity provider not covered by the Azure AD page.

Prerequisites: Familiarity with OIDC Setup.

Provider Checklist

Verify your IdP meets these requirements:

• Supports OpenID Connect (not just OAuth2)
• Exposes a .well-known/openid-configuration discovery document
• Supports the device authorization grant (required for nemo auth login)
• Issues signed JWT bearer tokens, or signed ID tokens if you configure bearer_token_source: "id_token"
• Includes email (or equivalent claim) in the selected bearer token
• If you use group-based role bindings, includes group or entitlement values in a JWT claim that can be configured as groups_claim
• If you use API-scope restrictions during OIDC login, can expose and return NeMo Helix API scopes such as platform:read and platform:write
• Supports JWKS for token signature validation

Configuration Template

auth:
  enabled: true
  oidc:
    enabled: true
    issuer: "<your-idp-issuer-url>"
    public_client:
      client_id: "<your-client-id>"
      default_scopes: "platform:read platform:write openid profile email offline_access"
      # scope_prefix: "api://<your-client-id>/"
    # Uncomment and adjust if your IdP uses non-standard claim names:
    # email_claim: "email"
    # subject_claim: "sub"
    # Set this to the claim that contains group or entitlement values
    # you will bind to NeMo Helix workspace roles.
    # groups_claim: "groups"

Keep short NeMo Helix API scope names in public_client.default_scopes. When the IdP expects api://<client-id>/platform:read, set public_client.scope_prefix to api://<client-id>/. Clients add that prefix to the API scopes they request, and discovery returns it on the interactive client. Omit the platform:* scopes when the login token should not restrict API access. Role bindings still apply.

Claim Mapping Reference

Related

• OIDC Setup — Full OIDC configuration guide.
• OIDC Setup — Claim mapping — JWT claims vs config defaults.
• Auth Configuration — Full config reference.