OpenID Connect configuration checklist
Prepare a confidential client and exact endpoints for company federation.
Collect the client values
ZubLMS brokers authorization code sign-in with S256 PKCE and signature validation. Endpoint discovery and provider-specific behaviour need review; entering a URL is not proof that the provider is supported.
- The exact issuer, including its expected path.
- Public HTTPS authorization, token and JWKS endpoints.
- A client ID and confidential client secret.
- The exact redirect URI displayed in Company settings.
Prepare and activate
- Register the confidential client with your company identity service.
- Set the exact callback URI; do not use wildcard redirects.
- Enter the values in the OIDC draft and save the secret through the protected settings form.
- Validate, request activation and complete the operator review.
- Test with an approved linked subject and check the current revision’s verified sign-in status.
Rotate credentials deliberately
Coordinate secret rotation with the platform operator. An empty secret field preserves the existing value; it does not erase it. The browser never receives the stored plaintext secret.
A contact-email change does not change the approved issuer/subject mapping. Do not resolve identity failures by automatically trusting a matching email.