Reference OAuth 2.0 configuration

In this section, you can find the configurations required for setting up integration via OAuth 2.0 between your instance of IDE Services and a third-party authentication provider. The setup is performed in both IDE Services and your authentication provider's system.

Set up IDE Services on your authentication provider's side

Start by configuring the integration with IDE Services on the side of your authentication provider. The exact steps will differ depending on your authentication provider.

Configure the following settings:

Redirect URI / Callback URI

Specify the callback endpoint to redirect the end user after authentication.

Example: https://<ide_services_server_domain.com>/api/login/authenticated

Replace <ide_services_server_domain.com> with your organization's public server URL. This value has to match the deployment URL set in your server configuration file.

Grant type: Authorization code

If applicable, select Authorization code as the method for obtaining access tokens from the authorization server.

Token endpoint authentication method

If applicable, specify how credentials are included in requests to the token endpoint.

Example: client_post

After setting up IDE Services in your authentication provider's system, save the following data that you will later need to configure the IDE Services Server:

Client ID
IDE Services requires the token’s aud (audience) claim to match the configured audience/clientId, otherwise the request will return a 401 error.
To further enhance the security, enable the iss (issuer) claim validation by specifying the issuer URL as the value of the tbe.auth.jwt-issuer-url property in your server configuration file — application.yaml or values.yaml (for Kubernetes installations.).
To disable aud validation against the configured audience/clientId, set the property tbe.auth.validate-jwt-audience: false in your server configuration file — application.yaml or values.yaml (for Kubernetes installations). Note that disabling aud validation is not recommended for security reasons.
Client secret
In some systems of authentication providers, you may need to create a client secret manually.
Login URL
You can obtain this URL by requesting the Well-known configuration.
Token URL
You can obtain this URL by requesting the Well-known configuration.
JWT certs URL
You can obtain this URL by requesting the Well-known configuration.

Configure provider details in your server configuration file

Use these examples to configure connection to your authentication server in your server configuration file — application.yaml or values.yaml (for Kubernetes installations.)

                    
            tbe:
              auth:
                login-url: "https://<provider-domain>/oauth2/authorize"
                token-url: "https://<provider-domain>/oauth2/token"
                jwt-certs-url: "https://<provider-domain>/oauth2/keys"
                accepted-jwt-token-types: [ 'JWT', 'at+jwt' ]
                validate-jwt-email-verified: false
                jwt-email-verified-claim: "email_verified"
                client-id: "application_identifier"
                client-secret: "your_client_secret"
                required-scopes: [ "profile", "email", "openid"]
                root-admin-emails:
                  - "your.company.admin@example.com"
                

tbe.auth.login-url

Provide a URL for logging in via your selected authentication provider.

tbe.auth.token-url

Provide a URL for obtaining an authorization token on the side of your authentication provider.

tbe.auth.jwt-certs-url

Specify a URL to the JSON Web Key (JWK) set that is used to validate JSON Web Tokens (JWT).

tbe.auth.accepted-jwt-token-types

Override the accepted JOSE typ header values for JWTs validated by IDE Services Server (login flow + JWT-bearer API calls).

Type of property: list of strings

Common values: JWT, at+jwt (RFC 9068), dpop+jwt (RFC 9449). Any string is accepted; matching is case-sensitive and exact.

When the property is set, only the listed values are accepted, including JWT. If JWT should still pass through, list it explicitly.
No wildcards / regex allowed.

tbe.auth.jwt-issuer-url

Specify expected URL of the JWT token issuer (e.g., https://accounts.google.com)

tbe.auth.validate-jwt-audience

Toggle aud (audience) validation (default: true)

tbe.auth.validate-jwt-email-verified

Toggle validation of the IdP's email verification claim (default: false)

true — IDE Services Server checks the email verification claim in the JWT token before proceeding with authentication. If the claim value is not true (missing, false, or non-boolean), the authentication request is rejected with the error: Email is not verified according to JWT token claim.
This enhances security of JWT-based OAuth authentication preventing an attacker to link their IdP identity to an existing user's account by exploiting unverified email claims in JWT tokens.
false — no email verification check is performed.

Notes:

This check only applies to JWT-based OAuth authentication. Do not enable it for SAML or LDAP authentication, as those protocols do not use JWT email verification claims.
Before enabling, verify that your IdP includes the email verification claim in issued JWT tokens and that it correctly reflects the verification status. If the claim is missing or always false, enabling this property will block all user login attempts.
If your IdP uses a non-standard claim name for email verification (e.g., a custom Okta claim), edit the jwt-email-verified-claim value to match it.
JWT token claim value must be parseable as a boolean.

tbe.auth.jwt-email-verified-claim

Specify the name of the JWT claim that indicates whether the email has been verified by the IdP.

Default value: email_verified

tbe.auth.client-id

Specify a public identifier for IDE Services that you set when configuring your authentication provider.

tbe.auth.client-secret

Specify a secret for IDE Services that you set when configuring your authentication provider.

tbe.auth.required-scopes

Define scopes that will be available to IDE Services when accessing a user account.

tbe.auth.root-admin-emails

List emails of users to grant admin rights.

tbe.auth.root-admin-subjects

List OAuth 2.0 subjects (sub) to grant admin rights.

This property functions similar to auth.root-admin-subjects, but matches subjects using the OAuth 2.0 sub field from authentication tokens instead of the email field.

For a full list of authentication properties, refer to Server configuration file.

                    
            ides:
              config:
                auth:
                  login-url: "https://<provider-domain>/oauth2/authorize"
                  token-url: "https://<provider-domain>/oauth2/token"
                  jwt-certs-url: "https://<provider-domain>/oauth2/keys"
                  accepted-jwt-token-types: [ 'JWT', 'at+jwt' ]
                  validate-jwt-email-verified: false
                  jwt-email-verified-claim: "email_verified"
                  client-id: "application_identifier"
                  client-secret: "your_client_secret"
                  required-scopes: [ "profile", "email", "openid"]
                  root-admin-emails:
                    - "your.company.admin@example.com"
                

ides.config.auth.login-url

Provide a URL for logging in via your selected authentication provider.

ides.config.auth.token-url

Provide a URL for obtaining an authorization token on the side of your authentication provider.

ides.config.auth.jwt-certs-url

Specify a URL to the JSON Web Key (JWK) set that is used to validate JSON Web Tokens (JWT).

ides.config.auth.accepted-jwt-token-types

Override the accepted JOSE typ header values for JWTs validated by IDE Services Server (login flow + JWT-bearer API calls).

Type of property: list of strings

Common values: JWT, at+jwt (RFC 9068), dpop+jwt (RFC 9449). Any string is accepted; matching is case-sensitive and exact.

When the property is set, only the listed values are accepted, including JWT. If JWT should still pass through, list it explicitly.
No wildcards / regex allowed.

ides.config.auth.jwt-issuer-url

Specify expected URL of the JWT token issuer (e.g., https://accounts.google.com)

ides.config.auth.validate-jwt-audience

Toggle aud (audience) validation (default: true)

ides.config.auth.validate-jwt-email-verified

Toggle validation of the IdP's email verification claim (default: false)

true — IDE Services Server checks the email verification claim in the JWT token before proceeding with authentication. If the claim value is not true (missing, false, or non-boolean), the authentication request is rejected with the error: Email is not verified according to JWT token claim.
This enhances security of JWT-based OAuth authentication preventing an attacker to link their IdP identity to an existing user's account by exploiting unverified email claims in JWT tokens.
false — no email verification check is performed.

Notes:

This check only applies to JWT-based OAuth authentication. Do not enable it for SAML or LDAP authentication, as those protocols do not use JWT email verification claims.
Before enabling, verify that your IdP includes the email verification claim in issued JWT tokens and that it correctly reflects the verification status. If the claim is missing or always false, enabling this property will block all user login attempts.
If your IdP uses a non-standard claim name for email verification (e.g., a custom Okta claim), edit the jwt-email-verified-claim value to match it.
JWT token claim value must be parseable as a boolean.

ides.config.auth.jwt-email-verified-claim

Specify the name of the JWT claim that indicates whether the email has been verified by the IdP.

Default value: email_verified

ides.config.auth.client-id

Specify a public identifier for IDE Services that you set when configuring your authentication provider.

ides.config.auth.client-secret

Specify a secret for IDE Services that you set when configuring your authentication provider.

ides.config.auth.required-scopes

Define scopes that will be available to IDE Services when accessing a user account.

ides.config.auth.root-admin-emails

List emails of users to grant admin rights.

ides.config.auth.root-admin-subjects

List OAuth 2.0 subjects (sub) to grant admin rights.

This property functions similar to auth.root-admin-subjects, but matches subjects using the OAuth 2.0 sub field from authentication tokens instead of the email field.

For a full list of authentication properties, refer to Values file.

23 July 2026