identityProvider
Registers an OpenID Connect identity provider (issuer) and returns its typed authentication schemes.
OidcProvider.session exposes OidcToken.Id
OidcProvider.introspectionBearer exposes OidcToken.Introspected
You can map those schemes to application principals with io.ktor.server.auth.mapPrincipal. Domain mapping is evaluated only when a derived scheme authenticates a protected route, never during the OAuth callback.
val google = oidc.identityProvider("google") {
issuer = "https://accounts.google.com"
bearer { audience = setOf("api") }
oauth {
clientId = "web-client"
clientSecret = "..."
}
}
val googleScheme = google.jwtBearer.mapPrincipal { token -> findUser(token.claims.subject) }Return
configured identity provider.
Parameters
provider name used in generated routes and authentication scheme names. Must contain lowercase letters, digits, and hyphen-separated segments only.
configures discovery, token validation, Bearer authentication, and OAuth flow.
Throws
when name or issuer is already configured, or the provider configuration is invalid.
when initial provider discovery fails after all configured attempts.