OpenID Connect (OIDC)
Membes supports authentication using OpenID Connect (OIDC), allowing external applications to authenticate users against Membes.
This guide explains how administrators configure and manage OIDC clients within the Membes Admin Portal.
Prerequisites
Before creating an OIDC client, obtain the following information from the application vendor or administrator:
Redirect URI(s)
Client ID (if predetermined by the application)
Required scopes (if different from the default)
Note: Production integrations require HTTPS redirect URIs.
Creating an OIDC Client
Navigate to Config & Settings > Integrations > OIDC Clients.
Select Add Client.
Complete the client configuration.
Select Save.
Client Configuration
Field | Required | Description |
|---|---|---|
Name | Yes | Internal name used to identify the integration (for example, Moodle Production). Only visible to administrators. |
Client ID | Yes | Unique identifier for the external application. Share this value with the application administrator. |
Client Secret | Yes | Secret used by the external application. Leave blank when editing an existing client to retain the current secret. |
Redirect URIs | Yes | Permitted callback URLs, entered one per line. These must exactly match the URLs configured in the external application. |
Entry URL | No | Optional URL used when initiating authentication from Membes. |
Scopes | No | Allowed scopes for this client. Default: |
Active | Yes | Enable or disable the client without deleting its configuration. |
Notes | No | Internal administrator notes. |
Information to Provide to the External Application
After the client has been created, provide the application administrator with:
Client ID
Client Secret
OIDC Discovery URL
https://<your-domain>/.well-known/openid-configurationManaging Existing Clients
Existing clients can be updated at any time to:
Update redirect URIs
Modify permitted scopes
Enable or disable the client
Update administrator notes
Troubleshooting
Issue | Resolution |
|---|---|
Redirect URI mismatch | Ensure the redirect URI configured in the external application exactly matches one of the registered Redirect URIs, including protocol, path and trailing slash. |
Invalid client credentials | Confirm the Client ID and Client Secret match the values configured in Membes and that the client is active. |
Unable to authenticate | Verify the client is enabled and the redirect URIs have been configured correctly. |
Signing key warning | Contact your infrastructure or platform administrator to verify the authentication service has been configured correctly. |