OpenID Connect Auth Module

Name

Stores the name of the authentication module. Use this setting to distinguish this module from other authentication modules in the Auth Modules list.

You can change the name of the authentication module using the Rename action. For more details, refer to Actions.

Accounts imported to YouTrack

Displays the number of users that have been imported to your YouTrack installation.

Set default

Designates the authentication module as the default for your installation. Only one authentication module can be set as the default at any time. If another module is currently set as the default, that state is cleared.

This option is only shown when the current authentication module is not designated as the default.

Clear default

Removes the authentication module as the default for your installation.

If none of the available authentication modules are designated as the default, unauthenticated users are always directed to the YouTrack login page.

This option is only shown when the current authentication module is designated as the default.

Redirect URI

Displays the authorized redirect URI used to register the connection to YouTrack in the authorization service.

Client ID

Stores the identifier that the authorization service uses to validate a login request. You generate this value in the authorization service when you configure the authorization settings for a web application and enter an authorized redirect URI.

Client Secret

Stores the secret or password used to validate the client ID. You generate this value in the authorization service together with the client ID.

Authorization URL

Stores the endpoint used to start the OAuth 2.0 authentication flow. YouTrack redirects the user to this URL to sign in with the connected identity provider.

Token URL

Stores the endpoint that YouTrack uses to exchange an authorization code for an access token.

JWKS URL

Stores an endpoint that returns the identity provider public keys (JWKS). YouTrack uses these keys to verify the signature of the identity token.

Scopes

A space-separated list of scopes YouTrack requests from the identity provider. Scopes determine which claim groups the identity provider returns.

Issuer

The expected issuer of the identity token. YouTrack uses this value to validate that the identity token was issued by the configured identity provider.

Logout URL

The URL YouTrack opens on logout to invalidate the identity provider session.

User identifier claim

Maps to the field that stores the value to copy to the User ID property in YouTrack.

User name claim

Maps to the field that stores the value to copy to the Username field in the YouTrack profile.

Full name claim

Maps to the field that stores the value to copy to the Full name field in the YouTrack profile.

Email claim

Maps to the field that stores the value to copy to the Email field in the YouTrack profile.

Email verified flag claim

Maps to the field that stores the value to copy to the verified email property in YouTrack.

Avatar URL claim

Maps to the field that stores the value to copy to the Avatar field in YouTrack.

Group membership claim

Maps to the attribute that stores group membership assignments by the connected identity provider. These can then be mapped to YouTrack groups on the Group Mapping tab.

User creation

Enables creation of YouTrack accounts for unregistered users who log in with an account that is stored in the connected identity provider. YouTrack uses the email address to determine whether the user has an existing account.

Auto-join groups

Adds users to a group when they log in with an account that is stored in the connected identity provider. You can select one or more groups. New users that auto-join a group inherit all the permissions assigned to this group.

We recommend that you add users to at least one group. Otherwise, a new user is only granted the permissions that are currently assigned to the All Users group.

Extension grant type

Saves the value used to identify the authentication module when used for extension grants. If a value is provided, YouTrack will process requests to exchange access tokens that are issued by the authentication service for tokens that grant access to YouTrack.

To exchange access tokens successfully, the authentication module must be authorized in the third-party authentication service and enabled in YouTrack.

To learn how to exchange access tokens using the YouTrack REST API, see Extension Grants.

Connection timeout

Sets the period of time to wait to establish a connection to the identity provider. The default setting is 5000 milliseconds (5 seconds).

Read timeout

Sets the period of time to wait to read and retrieve user profile data from the identity provider. The default setting is 5000 milliseconds (5 seconds).

Enable module

Enables the authentication module.

This option is only shown when the authentication module is currently disabled.

Disable module

Disables the authentication module.

This option is only shown when the authentication module is currently enabled.

Test login

Lets you enter a username and password to test the connection with the authentication service.

Rename

Lets you update the existing authentication module name and change its default icon.

You can find this action in the More options (...) menu.

Delete

Removes the authentication module from YouTrack. Use only when you have configured additional authentication modules that let users log into your YouTrack installation.

You can find this action in the More options (...) menu.