# OIDC Provider Setup

Configure your identity provider to work with AllCode Nexus so your users can authenticate with their corporate credentials.

## Overview

AllCode Nexus uses OIDC (OpenID Connect) to federate your identity provider with AWS IAM. Users authenticate through your IdP and receive temporary AWS credentials scoped to Amazon Bedrock access.

**Redirect URI (all providers):** `http://localhost:8400/callback`

After configuring your IdP, enter the **Client ID** and **Issuer URL** in the Nexus portal under **Settings** → **Identity Provider**.

---

## Okta

### Step 1: Create an Application

1. Log into your Okta Admin Console
2. Navigate to **Applications** → **Applications**
3. Click **Create App Integration**
4. Select **OIDC - OpenID Connect**
5. Select **Native Application** as the application type
6. Click **Next**

### Step 2: Configure the Application

1. **App integration name:** `AllCode Nexus`
2. **Grant type:** Authorization Code
3. **Sign-in redirect URIs:** `http://localhost:8400/callback`
4. **Sign-out redirect URIs:** (leave blank)
5. **Controlled access:** Assign to the groups or users who should have Claude Code access
6. Click **Save**

### Step 3: Collect Values

From the application's **General** tab:

- **Client ID** — Copy the Client ID
- **Issuer URL** — Format: `https://<your-domain>.okta.com` (or `https://<your-domain>.okta.com/oauth2/default` if using the default authorization server)

### Step 4: Enter in Nexus Portal

1. Go to [nexus.allcode.com](https://nexus.allcode.com) → **Settings** → **Identity Provider**
2. Select **Okta** as the provider type
3. Paste the **Client ID** and **Issuer URL**
4. Click **Save**

---

## Microsoft Entra ID (Azure AD)

### Step 1: Register an Application

1. Sign into the [Azure Portal](https://portal.azure.com)
2. Navigate to **Microsoft Entra ID** → **App registrations**
3. Click **New registration**
4. **Name:** `AllCode Nexus`
5. **Supported account types:** Accounts in this organizational directory only
6. **Redirect URI:** Select **Public client/native** and enter `http://localhost:8400/callback`
7. Click **Register**

### Step 2: Configure API Permissions

1. Go to **API permissions** → **Add a permission**
2. Select **Microsoft Graph** → **Delegated permissions**
3. Add: `openid`, `profile`, `email`
4. Click **Grant admin consent** for your organization

### Step 3: Collect Values

From the application's **Overview** page:

- **Client ID** — Application (client) ID
- **Issuer URL** — `https://login.microsoftonline.com/<tenant-id>/v2.0`

### Step 4: Enter in Nexus Portal

1. Go to [nexus.allcode.com](https://nexus.allcode.com) → **Settings** → **Identity Provider**
2. Select **Microsoft Entra ID** as the provider type
3. Paste the **Client ID** and **Issuer URL**
4. Click **Save**

---

## Auth0

### Step 1: Create an Application

1. Log into your [Auth0 Dashboard](https://manage.auth0.com)
2. Navigate to **Applications** → **Applications**
3. Click **Create Application**
4. **Name:** `AllCode Nexus`
5. **Type:** Native
6. Click **Create**

### Step 2: Configure the Application

1. Go to the **Settings** tab
2. **Allowed Callback URLs:** `http://localhost:8400/callback`
3. **Allowed Logout URLs:** (leave blank)
4. Scroll down and click **Save Changes**

### Step 3: Collect Values

From the application's **Settings** tab:

- **Client ID** — Copy the Client ID
- **Issuer URL** — `https://<your-tenant>.auth0.com`

### Step 4: Enter in Nexus Portal

1. Go to [nexus.allcode.com](https://nexus.allcode.com) → **Settings** → **Identity Provider**
2. Select **Auth0** as the provider type
3. Paste the **Client ID** and **Issuer URL**
4. Click **Save**

---

## Verification

After saving your IdP configuration in the Nexus portal:

1. Navigate to **Settings** → **Identity Provider**
2. Click **Test Connection**
3. A browser window will open for authentication
4. On success, the portal will show a green **Verified** status

If the test fails, verify:

- The redirect URI is exactly `http://localhost:8400/callback`
- The Client ID and Issuer URL are correct
- The application is assigned to at least one user or group
- The application grant type includes Authorization Code

## Next Steps

- [Deploy to Users](./deployment.md#step-7-distribute-to-users)
- [Configure Quota Policies](./quota-policies.md)