OIDC quickstart for power users

This article complements Setting up SSO with a faster, value-only path for engineers who already speak OIDC.

Endpoints

Authorization: <issuer>/authorize
Token:         <issuer>/token
Userinfo:      <issuer>/userinfo
JWKS:          <issuer>/.well-known/jwks.json
Discovery:     <issuer>/.well-known/openid-configuration

LeadForge speaks the Authorization Code with PKCE flow.

Required claims

We read these from the ID token (and fall back to userinfo if a claim is missing):

• sub — stable user identifier; stored as `sso_external_id`.
• email — primary email; must be verified.
• name — used for `full_name` on first login.

Group / role mapping

Optional. Configure a JSONPath against the ID token under SSO → Advanced → Role mapping to lift LeadForge roles (admin / manager / viewer) directly from your IdP groups.