OidcIdentityProvider is a datatype for an OIDC identity provider. It implements the interface datatype, IdentityProviderAuthentication.

This datatype is used by the newOIDCIdentityProvider(), updateOIDCIdentityProvider(), and newAzureAdOidcIdentityProvider() mutation fields. It's also used by the oidcIdentityProvider() query field.

Table: OidcIdentityProvider

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Jun 26, 2025 
authenticationMethodAuthenticationMethodAuthyes Long-Term The authentication method used. See AuthenticationMethodAuth.
authorizationEndpointstring  Long-Term A URL to the endpoint a user should be redirected to when authorizing.
clientIdstringyes Long-Term The unique identifier for the client.
clientSecretstringyes Long-Term The password for the client.
debugbooleanyes Long-Term Whether debugging is enabled.
defaultIdpbooleanyes Long-Term Whether the identity provider is the default.
domains[string]yes Long-Term The domains authorized by the OIDC identity providers.
federatedIdpstring  Long-Term The Federated IdP.
groupsClaimstring  Long-Term The name of the claim to interpret as the groups in LogScale. The value in the claim must be an array of strings. Optional. Defaults to humio-groups.
humioManagedbooleanyes Long-Term Whether authentication is managed by LogScale.
idstringyes Long-Term The unique identifier for the OIDC identity provider.
issuerstringyes Long-Term The issuer of the OIDC authentication.
jwksEndpointstring  Long-Term A URL to the JWKS endpoint for retrieving keys for validating tokens. Required.
lazyCreateUsersbooleanyes Long-Term Whether to wait to create users until necessary.
namestringyes Long-Term The name of the OIDC identity provider.
registrationEndpointstring  Long-Term To use OIDC as a client, PUBLIC_URL must be set, LogScale must be registered as a client with your OpenID provider, and the provider must allow %PUBLIC_URL%/auth/oidc as a valid redirect endpoint for the client.
scopeClaimstring  Long-Term The scope claim.
scopes[string]yes Long-Term Comma-separated list of scopes to add in addition to the default requested scopes (openid, email, and profile).
tokenEndpointstring  Long-Term A URL to the token endpoint used to exchange a authentication code to an access token. Required for clients.
tokenEndpointAuthMethodstringyes Long-Term A URL to the token endpoint used to exchange a authentication code to an access token. Required for clients.
userClaimstringyes Long-Term The name of the claim to interpret as username in LogScale. The value in the claim must be a string. Defaults to humio-user. Can be set to email if using emails as usernames.
userInfoEndpointstring  Long-Term A URL to the user info endpoint used to retrieve user information from an access token.