Skip to content

Version update info for OIDC #11729

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Karuna-Mendix wants to merge 3 commits into
base: development
Choose a base branch
from
Open

Version update info for OIDC #11729

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bcce848
version update info for OIDC
Karuna-Mendix Aug 13, 2026
ba07624
Add corrections
Karuna-Mendix Aug 17, 2026
81b093d
Add upgrading info
Karuna-Mendix Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 12 additions & 8 deletions content/en/docs/marketplace/platform-supported-content/modules/oidc.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,7 @@ This section provides an overview of updates for the OIDC SSO module across diff

| Mendix Version | OIDC SSO Module Version | Important Migration Changes | Additional Information |
| --- | --- | --- | --- |
| 10.24.0 and above | 4.x.x | - | New constant (`EnableAudienceValidation`) has been introduced for the api security. Configure the required values as they are mandatory for the api security flow. |

@JaapF JaapF Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we could something like :

"Given the fact that it is enabled by default, the customers need to configure resource path and expected audience value.
As an alternative, customers can chose to disable audience validation (not recommended)."

| 10.24.0 and above | 4.6.0 | - | New constant (`OIDC.NonceCookieSameSite`) has been introduced. |
| 10.24.0 and above | 4.5.0 | - | New Admin UI and new constants have been introduced. |
| | | | `Anonymous` module role has been removed. |
Expand Down Expand Up @@ -392,13 +393,14 @@ See the section [Optional Features](#optional) information on additional optiona
#### API Security Configuration for Client Credential Grant {#client-credential-grant}

1. Start your app, log in as an administrator, for example, *demo_administrator*, and access the Client Credential setup page.
2. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints.
2. If you are using version x.x.x of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails as audience validation is enabled by default.

@JaapF JaapF Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would want to have some guidance for citizen developers, who are not IAM experts.

Maybe we can add:
"What the proper audience value is for your API, depends on the IdP you are using. For customers using Entra ID, the expected audience value also depends on how you've registered your API at Entra ID. When using version 2 tokens, your application's client ID is the expected audience value."

This needs to be checked with the team for correctness.

3. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints.

{{% alert color="info" %}}If the endpoint URL does not already end with `/.well-known/openid-configuration`, include it at the end. According to the specifications, the URL you need to enter typically ends with `/.well-known/openid-configuration`.{{% /alert %}}

If you do not have an automatic configuration URL, you can fill in the other endpoints manually.
3. Optionally, you can select the **Custom AccessToken Parsing** microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information.
4. Click **Save**. Once you have completed these steps, the Client Credential Configuration is ready for testing.
4. Optionally, you can select the **Custom AccessToken Parsing** microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information.
5. Click **Save**. Once you have completed these steps, the Client Credential Configuration is ready for testing.

#### Microsoft Entra ID Client Configuration for APIs {#azure}

Expand Down Expand Up @@ -544,9 +546,9 @@ The following constants are mandatory when creating an OIDC SSO Client Credentia
Example: `OIDC.Default_SAM_TokenProcessing_CustomATP`
* **IsClientGrantOnly** (*default: false*) – allow to create Client Credential Configuration in the application

{{% alert color="warning" %}}
When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration.
{{% /alert %}}
{{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration.
{{% /alert %}}
* **EnableAudienceValidation** (Boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience.

@JaapF JaapF Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is 'resource path' in this context? Let's explain. Also because it's not a concept from OAuth/OIDC, so i expect customers to be confused as well.


## Configuring Multi-Domain {#multi-domain}

Expand Down Expand Up @@ -789,7 +791,7 @@ You can create your own APIs within your Mendix app and secure the end point ove

1. Create a REST API endpoint which needs to be secured.
2. Use **Custom** as the [authentication method](/refguide/published-rest-service/#authentication) to secure the endpoint with an access token.
3. Select the `OIDC.APIAuthentication` microflow which has `HTTPRequest` as the input and returns `System.User` as the output.
3. Select the `OIDC.APIAuthentication` microflow from the **OIDC.APIAuthentication** folder of the module which has `HTTPRequest` as the input and returns `System.User` as the output.

### Using `APIAuthentication` for Client Credentials Grant

Expand All @@ -798,7 +800,9 @@ The client credentials grant type is used when applications request an access to
1. Request an Access Token using `/token` endpoint.
2. Access the Secured API Endpoint
3. `APIAuthentication` will validate the token and extract the claims.
4. The OIDC SSO module checks if the `sub` claim (which contains the `client-id`) is present in the access token. If it is not, the module will verify the `client_id`, `appid`, or `cid` parameters. If none of these are found, it will throw an exception message.
4. The OIDC SSO module checks
* if the `sub` claim (which contains the `client-id`) is present in the access token. If it is not, the module will verify the `client_id`, `appid`, or `cid` parameters. If none of these are found, it will throw an exception message.
* if the `audiencevalidationenabled` is true then verify the resource path and expected audince based on the configured values.
5. Create a new user using the client ID from the token if one does not already exist.

{{% alert color="info" %}}
Expand Down