Configuring Well-Known OpenID Connect Providers

In order to set up OIDC for GitHub you need to create a new OAuth application in your GitHub developer settings:

Make sure to fill in the appropriate details, but more importantly the Authorization Callback URL, set to http://localhost:8080/_renarde/security/github-success (if you intend to test this using the Quarkus DEV mode).

Now click on Register application and you’ll be shown your application page:

You need to click on Generate a new client secret, confirm your credentials, and write down your Client ID and Client secret (especially that one, because you will not be able to see it again later from that page, but you can always recreate one, do don’t worry too much):

Now add the following configuration to your application.properties:

quarkus.oidc.provider=github will request GitHub to add a user:email scope to issued access tokens. For information about overriding this scope or requesting more scopes, see the Provider scopes section.

In order to set up OIDC for Google you need to create a new project in your Google Cloud Platform console:

Pick a project name and click on CREATE.

Now make sure you select your project in the top selector, and click on the left-hand bar menu on APIs and Services > OAuth consent screen:

Select External to authorise any Google user to log in to your application and press CREATE:

Now you can fill in your application name, your support email, your developer contact information and press SAVE AND CONTINUE:

Do not add any scopes on the next page, and press SAVE AND CONTINUE:

Do not add any test user on the next page, and press SAVE AND CONTINUE:

Click on the top menu CREATE CREDENTIALS > OAuth client ID:

Select Web application as Application type, and add http://localhost:8080/_renarde/security/oidc-success in the Authorised redirect URIs list, then press CREATE:

Copy your Client ID and Client Secret:

You can now configure your application.properties:

quarkus.oidc.provider=google will request Google to add openid, email and profile scopes to issued access tokens. For information about overriding these scopes or requesting more scopes, see the Provider scopes section.

Create a Mastodon account. You must pick a server, for example, mastodon.social. Select a Development option in your account and register an application, for example:

Select the registered application:

and note its client id and client secret properties, use them to configure your application.properties:

By default, quarkus.oidc.provider=mastodon sets quarkus.oidc.auth-server-url to the https://mastodon.social Mastodon server address.

You can override quarkus.oidc.auth-server-url if you have created your account in another Mastodon server, for example:

In order to set up OIDC for Microsoft you need to go to your Microsoft Azure Portal, and search for Azure Active Directory, then click on it:

Once there, on the left side under Manage, click on App registrations then click on New registration:

Fill in your application name, select Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) to allow anyone to log in, and add a Web Redirect URI as http://localhost:8080/_renarde/security/oidc-success, then click on Register:

On that resulting page, copy the Client Id (under Application (client) ID, then click on Add a certificate or secret:

Now, under Client secrets (0), click on New client secret:

Click on Add in that dialog without changing anything:

On the resulting page, copy your Secret Value:

You can now configure your application.properties:

quarkus.oidc.provider=microsoft will request Microsoft to add openid, email and profile scopes to issued access tokens. For information about overriding these scopes or requesting more scopes, see the Provider scopes section.

In order to set up OIDC for Apple you need to create a developer account, and sign up for the 99€/year program, but you cannot test your application on localhost like most other OIDC providers: you will need to run it over https and make it publicly accessible, so for development purposes you may want to use a service such as https://ngrok.com.

Go to Create a new identifier and press +

Don’t touch anything, keep App IDs selected, and press Continue:

Don’t touch anything, keep App selected, and press Continue:

Enter a description and a Bundle ID (use your application package name):

Then scroll down to find the Sign in with Apple Capability, select it, and press Continue:

Write down your App ID Prefix, then press Register:

Back on the Identifiers page, press +:

Select Service IDs and press Continue:

Enter a description and Bundle ID (use your application package name), then press Continue:

Now press Register:

Back on the service list, click on your newly created service:

Enable Sign in with Apple and press Configure:

Add your domain and return URL (set to <host>/_renarde/security/oidc-success) and press Next:

Now press Done:

Now press Continue:

And now press Save:

Go to the Keys page on the left menu, and press +:

Fill in a key name, enable Sign in with Apple, and press Configure:

Select your Primary App ID and press Save:

Back on the key page, press Continue:

Now press Register:

Write down your Key ID, download your key and save it to your Quarkus application in src/main/resources/AuthKey_<KEYID>.p8:

You can now configure your application.properties:

quarkus.oidc.provider=apple will request Apple to add openid, email and name scopes to issued access tokens. For information about overriding these scopes or requesting more scopes, see the Provider scopes section.

Facebook you will not be let you test your application on localhost like most other OIDC providers: you will need to run it over https and make it publicly accessible, so for development purposes you may want to use a service such as https://ngrok.com.

In order to set up OIDC for Facebook start by Creating an application, select None as an app type, and press Next:

Now enter an application name, and contact email, and press Create app:

On the app page, click Set up on the Facebook login product:

Quick the Quickstarts page and click on Facebook login > Settings on the left menu:

Enter your Redirect URIs (set to <host>/_renarde/security/oidc-success) and press Save changes:

Now go to Settings > Basic on the left-hand menu, and write down your App ID and App secret:

You can now configure your application.properties:

quarkus.oidc.provider=facebook will request Facebook to add email and public_profile scopes to issued access tokens. For information about overriding these scopes or requesting more scopes, see the Provider scopes section.

You can use Twitter for OIDC login, but at the moment, it restricts access to the user’s email, which means you will have to obtain it and verify it yourself.

In order to set up OIDC for Twitter start by Creating a project, enter a project name, and press Next:

Enter a use case, and press Next:

Enter a project description, and press Next:

Now enter an application name, and press Next:

Write down your keys, because they will not be displayed again, and press App Settings:

Navigate down to the User authentication settings section and press Set up:

Check the OAuth 2.0 check box:

Select Web App as application type, then fill in your application details (use <host>/_renarde/security/twitter-success for the Callback URI).

Now press Save:

You can now copy your Client ID and Client Secret and press Done:

You can now configure your application.properties:

quarkus.oidc.provider=twitter will request Twitter to add offline.access, tweet.read and users.read scopes to issued access tokens. For information about overriding these scopes or requesting more scopes, see the Provider scopes section.

X is a new name for Twitter. You can currently use either quarkus.oidc.provider=x or quarkus.oidc.provider=twitter but only quarkus.oidc.provider=x may end up supported in the future.

Please see Twitter for more information about registering your Quarkus application in X (Twitter).

Create a Spotify application:

Don’t forget to add http://localhost:8080 as a redirect URI for testing during development purposes. You should get a client id and secret generated once a Spotify application setup has been complete, for example:

You can now configure your application.properties:

quarkus.oidc.provider=spotiify will request Spotify to add user-read-private and user-read-email scopes to issued access tokens. For information about overriding these scopes or requesting more scopes, see the Provider scopes section.

Create a Twitch application:

You can now configure your application.properties:

Create a Discord application:

You now can get your client id and secret:

You can now configure your application.properties: