Configure generic OAuth 2.0 authentication for your Devana.ai whitemark instance. This provider allows integration with any OAuth 2.0 compliant identity provider that isn't covered by the specialized providers.
| Variable | Description | Required | Example |
|---|---|---|---|
OAUTH2_CLIENT_ID | OAuth 2.0 Client ID | Yes | your-client-id |
OAUTH2_CLIENT_SECRET | OAuth 2.0 Client Secret | Yes | your-client-secret |
OAUTH2_CALLBACK_URL | Callback URL for authentication | Yes | https://your-domain.com/auth/oauth2/callback |
OAUTH2_AUTHORIZATION_URL | Authorization endpoint URL | Yes | https://provider.com/oauth/authorize |
OAUTH2_TOKEN_URL | Token endpoint URL | Yes | https://provider.com/oauth/token |
The setup process varies by provider, but generally involves:
Register Application:
https://your-domain.com/auth/oauth2/callbackConfigure Scopes:
openid, profile, email, offline_accessGet Endpoint URLs:
Add the following variables to your environment configuration:
# Generic OAuth2 Configuration
OAUTH2_CLIENT_ID=your-client-id
OAUTH2_CLIENT_SECRET=your-client-secret
OAUTH2_CALLBACK_URL=https://your-domain.com/auth/oauth2/callback
OAUTH2_AUTHORIZATION_URL=https://provider.com/oauth/authorize
OAUTH2_TOKEN_URL=https://provider.com/oauth/token
Configure your whitemark to include OAuth 2.0 as an allowed provider:
{
"allowedProviders": ["OAUTH2"],
"registrationType": ["SSO"]
}
The OAuth 2.0 provider should return user information in the token or via a UserInfo endpoint:
| OAuth2 Field | Devana.ai Field | Notes |
|---|---|---|
email | email | Primary identifier |
given_name | firstName | First name |
family_name | lastName | Last name |
name | displayName | Full name |
sub or id | providerId | Unique user identifier |
The application requests the following default scopes:
openid: Required for OpenID Connect complianceprofile: Access to profile information (name, picture, etc.)email: Access to email addressoffline_access: Refresh token for long-term accessOAUTH2_CLIENT_ID=devana-client
OAUTH2_CLIENT_SECRET=your-keycloak-secret
OAUTH2_CALLBACK_URL=https://your-domain.com/auth/oauth2/callback
OAUTH2_AUTHORIZATION_URL=https://keycloak.yourcompany.com/auth/realms/master/protocol/openid-connect/auth
OAUTH2_TOKEN_URL=https://keycloak.yourcompany.com/auth/realms/master/protocol/openid-connect/token
OAUTH2_CLIENT_ID=your-okta-client-id
OAUTH2_CLIENT_SECRET=your-okta-secret
OAUTH2_CALLBACK_URL=https://your-domain.com/auth/oauth2/callback
OAUTH2_AUTHORIZATION_URL=https://dev-123456.okta.com/oauth2/default/v1/authorize
OAUTH2_TOKEN_URL=https://dev-123456.okta.com/oauth2/default/v1/token
OAUTH2_CLIENT_ID=your-auth0-client-id
OAUTH2_CLIENT_SECRET=your-auth0-secret
OAUTH2_CALLBACK_URL=https://your-domain.com/auth/oauth2/callback
OAUTH2_AUTHORIZATION_URL=https://yourcompany.auth0.com/authorize
OAUTH2_TOKEN_URL=https://yourcompany.auth0.com/oauth/token
If your OAuth provider doesn't follow standard conventions, you may need to customize user profile handling:
Custom UserInfo Endpoint:
Non-standard Claims:
Some providers require additional parameters in the authorization request:
// Example: Adding audience parameter for Auth0
authorizationURL: 'https://yourcompany.auth0.com/authorize?audience=your-api-identifier'
For enhanced security, consider implementing token validation:
JWT Token Validation:
Introspection Endpoint:
Invalid client:
OAUTH2_CLIENT_ID and OAUTH2_CLIENT_SECRET are correctRedirect URI mismatch:
OAUTH2_CALLBACK_URL exactly matches registered redirect URIInvalid authorization code:
Token endpoint error:
OAUTH2_TOKEN_URL is correct and accessibleUser profile not available:
Enable debug logging to see:
If your provider requires a separate UserInfo call:
// Custom userProfile implementation would be needed
// This is not currently implemented in the generic OAuth2 provider
For providers with non-standard scopes:
// Modify scope array in provider configuration
scope: ["custom_profile", "custom_email", "custom_openid"]
The current generic OAuth2 implementation:
If migrating from a specific provider (e.g., Google, GitHub) to generic OAuth2:
Use the generic OAuth2 provider when:
Consider specific providers when: