Identity Providers

Identity providers allow users to authenticate with OctoMesh using external identity systems. Each tenant can configure multiple providers independently.

Provider Types

Type	Use Case	Key Properties
Google	Google OAuth 2.0	ClientId, ClientSecret
Microsoft	Microsoft Account OAuth 2.0	ClientId, ClientSecret
Facebook	Facebook OAuth 2.0	ClientId, ClientSecret
Azure Entra ID	Corporate Azure AD / Entra ID	TenantId, ClientId, ClientSecret, Authority
OpenLDAP	LDAP directory authentication	Host, Port, UserBaseDn, UserNameAttribute
Active Directory	Microsoft Active Directory (LDAPS)	Host, Port
OctoTenant	Cross-tenant authentication via parent tenant	ParentTenantId

Common Properties

All identity providers share these base properties:

Property	Description	Default
Name	Unique display name (3-100 chars)	—
IsEnabled	Whether the provider is active	—
AllowSelfRegistration	Allow new users to register on first login	true
DefaultGroupRtId	RtId of a group to assign to new users	null
Description	Optional description	null

AllowSelfRegistration

When true (default), any user who authenticates via this provider is automatically registered in the tenant on first login. When false, users must be pre-created by an administrator before they can log in.

DefaultGroupRtId

When set, new users who register via this provider are automatically added to the specified group, inheriting all of that group's roles. This is useful for granting a baseline set of permissions to all users from a particular provider.

OAuth App Registration — Redirect URIs

For the redirect-based providers you must register a callback URI with the external provider (Google Cloud Console, Azure Portal, Facebook Developer Console). The paths are fixed by the identity service:

Provider	Redirect URI path
Google	/signin-google
Microsoft Account	/signin-microsoft
Facebook	/signin-facebook
Azure Entra ID	/auth/signin-callback

The full URL is https://{identity-host}/{path} — for example https://identity.example.com/auth/signin-callback for Azure Entra ID, or https://localhost:5003/signin-google for local development. The LDAP-based providers (OpenLDAP, Active Directory) and OctoTenant use direct credential entry on the login page and need no redirect URI.

Azure Entra ID path

The Entra ID callback is /auth/signin-callback — not the ASP.NET default /signin-oidc. A mismatch surfaces as an AADSTS50011 redirect-URI error on the Microsoft login page.

Configuring Providers via CLI

OAuth Providers (Google, Microsoft, Facebook)

octo-cli -c AddOAuthIdentityProvider \
  -n "Google Login" \
  -t "google" \
  -cid "<client-id>" \
  -cs "<client-secret>" \
  -e true \
  -asr true \
  -dgid "<default-group-rtid>"

Azure Entra ID

octo-cli -c AddAzureEntryIdIdentityProvider \
  -n "Corporate Azure AD" \
  -t "<azure-tenant-id>" \
  -cid "<client-id>" \
  -cs "<client-secret>" \
  -e true \
  -asr true \
  -dgid "<default-group-rtid>"

OpenLDAP

octo-cli -c AddOpenLdapIdentityProvider \
  -n "Corporate LDAP" \
  -h "ldap.example.com" \
  -p 636 \
  -ubdn "cn=users,dc=example,dc=com" \
  -uan "uid" \
  -e true \
  -asr false

Active Directory

octo-cli -c AddAdIdentityProvider \
  -n "Corporate AD" \
  -h "ad.example.com" \
  -p 636 \
  -e true

AD Group Synchronization

Active Directory providers automatically synchronize AD group memberships with OctoMesh groups on every login. Create OctoMesh groups with the same name as your AD groups and assign roles to them. See Groups — Active Directory Group Synchronization for details.

OctoTenant (Cross-Tenant)

octo-cli -c AddOctoTenantIdentityProvider \
  -n "Parent Tenant Auth" \
  -ptid "<parent-tenant-id>" \
  -e true \
  -asr true \
  -dgid "<default-group-rtid>"

See Cross-Tenant Authentication for details on how OctoTenant providers work.

Update Provider

The update command works for all provider types. It fetches the existing provider, preserves type-specific properties, and applies the changes:

octo-cli -c UpdateIdentityProvider \
  -id "<provider-rtid>" \
  -n "Updated Name" \
  -e true \
  -asr false \
  -dgid "<default-group-rtid>"

For OAuth-based providers, you can also update the client credentials:

octo-cli -c UpdateIdentityProvider \
  -id "<provider-rtid>" \
  -n "Updated Name" \
  -e true \
  -cid "<new-client-id>" \
  -cs "<new-client-secret>"

Delete Provider

octo-cli -c DeleteIdentityProvider -id "<provider-rtid>"

List Providers

octo-cli -c GetIdentityProviders