Skip to content
Open Console →

Generic OIDC settings

The endpoints, scopes, and claims any OIDC-capable tool needs to sign in through Longbridge.

Any tool that speaks OpenID Connect can sign in through Longbridge. Register a connected app for it, then use these values.

Endpoints

Most tools only need the issuer (they discover the rest); the individual endpoints are listed for the ones that ask.

SettingValue
Issuerhttps://console.lngbrdg.com
Discoveryhttps://console.lngbrdg.com/.well-known/openid-configuration
Authorization endpointhttps://console.lngbrdg.com/api/auth/oauth2/authorize
Token endpointhttps://console.lngbrdg.com/api/auth/oauth2/token
Userinfo endpointhttps://console.lngbrdg.com/api/auth/oauth2/userinfo
JWKShttps://console.lngbrdg.com/api/auth/jwks

The client id and secret come from the connected app — the secret is shown once at registration and on rotation, never again.

Scopes

Request openid profile email for sign-in, add groups to receive roles, and add offline_access if the tool refreshes tokens instead of re-authenticating:

openid profile email groups offline_access

The groups claim

With the groups scope, the ID token (and userinfo) carries the signed-in member’s roles:

  • owner — the organization owner.
  • Built-in role ids, for example org.admin, platform.viewer, gitops.admin, controlplane.operator.
  • Custom roles by their name, lowercased and hyphenated: a role named Platform Oncall arrives as platform-oncall.

Map these to the tool’s own permissions. Creating a group is creating a role: define a custom role under Organization → Access, grant it, and it appears in the claim at the member’s next sign-in.

Redirect URIs

Exact match, no wildcards. Use https:// URLs — or http:// on 127.0.0.1 or localhost for CLIs and local development (public apps with PKCE).

Sign-in rules

  • Only members of your organization can complete a sign-in, whatever the tool’s own default-access behavior is.
  • If the app restricts sign-in to named roles, only members holding one of them get through.
  • Removing a member (or their role) takes effect at the next sign-in and the next token refresh — live refresh tokens don’t outlive access.
Edit this page on GitHub