new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Plugins · all subjects

oidc-provider/configuration

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Trusted Clients Configuration

Trusted clients can be configured in the OIDC provider to bypass database lookups for better performance. Configure via the trustedClients option with an array of client objects. Each trusted client object contains: clientId (string), clientSecret (string), name (string), type ("web" | "native"), redirectUrls (string[]), disabled (boolean), skipConsent (boolean, when true the client bypasses the consent screen), and metadata (object). Trusted clients are first-party applications and internal services that can optionally skip the consent screen for improved user experience.

Custom Claims in OIDC Provider

Use the getAdditionalUserInfoClaim function to add custom claims based on scopes and client metadata. The function receives (user, scopes, client) as parameters and returns Record<string, any>. Additional claims returned by this function are included in both the UserInfo endpoint response and the ID token. Example: check if scopes.includes("profile") to add department and job_title, or check client.metadata?.includeRoles to add user roles.

OIDC Consent Screen Configuration

Customize the consent screen by providing a consentPage option during OIDC provider initialization. The plugin redirects users to the specified path with query parameters: consent_code, client_id, and scope. The user's consent decision is submitted via POST /oauth2/consent endpoint. Two methods are supported: (1) URL Parameter method passes consent_code in the request body; (2) Cookie-Based method stores the consent code in a signed cookie and does not require passing consent_code in the request. Trusted clients with skipConsent: true bypass the consent screen entirely.

OIDC Login Page Handling

Configure the loginPage option during OIDC provider initialization with the path to your login page. When users are redirected to the OIDC provider for authentication and are not already logged in, they are redirected to this login page. No additional handling is required from the application side; when a new session is created, the plugin automatically continues the authorization flow.

OIDC Metadata Customization

Customize OIDC metadata by providing a metadata configuration object during initialization. The object can include: issuer, authorization_endpoint, token_endpoint, and other custom metadata fields. These customize the OIDC discovery metadata returned by the provider.

JWKS Endpoint and JWT Plugin Integration

To make the OIDC Provider compliant with OIDC specification, disable the /token endpoint by adding it to disabledPaths array, as the OAuth equivalent is located at /oauth2/token instead. The OIDC Provider plugin can integrate with the JWT plugin to provide asymmetric key signing for ID tokens verifiable at a JWKS endpoint. Set useJWTPlugin: true in the OIDC provider options and add the jwt() plugin to the plugins array. When useJWTPlugin: false (default), ID tokens are signed with HMAC-SHA256 using the application secret.

Dynamic Client Registration Option

Enable dynamic client registration by setting allowDynamicClientRegistration: true in the OIDC provider options. This makes the /register endpoint publicly available, allowing clients to register dynamically without requiring authentication.

OIDC Provider Configuration Options

OIDC Provider configuration options are: allowDynamicClientRegistration (boolean, enable or disable dynamic client registration); metadata (OIDCMetadata, customize OIDC provider metadata); loginPage (string, path to custom login page); consentPage (string, path to custom consent page); trustedClients (array of Client objects with optional skipConsent boolean); getAdditionalUserInfoClaim (function receiving user, scopes, client and returning Record<string, any>); useJWTPlugin (boolean, when true ID tokens signed with JWT plugin asymmetric keys, when false default ID tokens signed with HMAC-SHA256 using application secret); schema (AuthPluginSchema, customize OIDC provider schema).

Give your agent this brain