Shield OIDC config builder

Provider

Microsoft Entra ID Who can sign in Directory (tenant) ID or primary domain Allowed tenants tenant IDs, one per line; empty = any Role tenants tenants whose app roles you trust Cloud

Google Workspace domain only accounts from this Workspace

Okta Okta domain Authorization server Server ID

Keycloak Keycloak address Realm Older install with /auth in the path

Auth0 Auth0 domain or your custom domain

Your provider Issuer URL where /.well-known/openid-configuration lives

Your app

App address Provider key used in URLs

Button label "Sign in with …"

Who gets in Create an account on first sign-in Allowed email domains optional; only trusted emails count Link existing accounts by email

Roles and groups optional Claim with groups or roles

Also remove mapped groups people no longer have

More options

Sign out at the provider too Run Shield's login action (e.g. Email2FA) for SSO too Client authentication Route prefix

Redirect URI to register

Post-logout URI

app/Config/ShieldOidc.php

.env

Full guides and every option: Shield OIDC documentation. After setup, php spark oidc:check verifies the provider for real.