This reference describes each OpenID Connect (OIDC) configuration field available when creating a Custom OIDC Application in Fixiam.

Use this guide to understand the purpose of each field, where to obtain its value, whether it is required, and the impact of an incorrect configuration.

Field	Description	Who Provides the Value?	Required	Example	If Configured Incorrectly
Client ID	A unique identifier for the application registered in Fixiam. This value identifies the application whenever it requests authentication or tokens from Fixiam.	Administrator	Yes	`my-company-app`	The application will fail to authenticate because Fixiam cannot identify the client.
Redirect URL	The callback URL where Fixiam redirects users after successful authentication. This value must exactly match the Redirect URI configured in the application. Redirect URLs are case sensitive.	Application	Yes	`https://app.company.com/callback`	Users may receive an Invalid Redirect URI error or authentication may fail.
Allowed Logout URLs	One or more trusted URLs where users can be redirected after signing out of both Fixiam and the application. Only the configured URLs are permitted for post logout redirection.	Application	Optional	`https://app.company.com/logout`	Users may not be redirected correctly after signing out or logout requests may be rejected.
Access Token Expiry (In Hours)	Specifies how long an Access Token remains valid before the application must request a new token. Shorter expiry periods improve security but may require more frequent token refreshes.	Administrator	Yes	`1`	Users may be prompted to reauthenticate more often, or tokens may remain valid longer than intended by your organization's security policy.
Refresh Token Expiry (In Days)	Specifies how long a Refresh Token remains valid. Refresh Tokens allow the application to obtain new Access Tokens without requiring users to sign in again.	Administrator	Yes	`30`	Users may need to sign in more frequently, or refresh tokens may remain active longer than intended.
Subject	Determines which Fixiam user attribute is used as the unique user identifier (`sub` claim) in the ID Token. The selected value should uniquely identify every user and remain consistent over time.	Administrator	Yes	Email Address, Username, Employee ID	The application may be unable to associate authenticated users with their existing accounts.
Client Credential Grant	Enables the OAuth 2.0 Client Credentials Grant. This allows applications or backend services to authenticate directly with Fixiam without user interaction. This option should only be enabled for machine to machine integrations.	Administrator	Optional	Enabled	Applications that rely on the Client Credentials flow will be unable to obtain Access Tokens if this option is disabled.
Attribute Mapping	Defines which Fixiam user attributes are returned as OIDC claims in the ID Token or UserInfo response. Configure the mappings based on the application's requirements.	Administrator	Optional	`email → email`, `givenName → given_name`	Users may authenticate successfully, but required user information may be missing or incorrectly mapped.

OIDC Values Generated by Fixiam

After saving the OIDC application, Fixiam generates the OpenID Connect configuration required by your application.

Depending on your application's capabilities, these values can be entered manually or discovered automatically using the Discovery Endpoint.

Configuration	Description
Issuer URL	The unique identifier of the Fixiam OpenID Provider. Applications use this value to validate tokens and establish trust with Fixiam.
Discovery Endpoint	A standard OpenID Connect endpoint that exposes the complete OIDC configuration, including supported endpoints, signing keys, and capabilities. Applications that support automatic discovery should use this endpoint whenever possible.
Authorization Endpoint	The endpoint where authentication requests are sent when users begin the sign in process.
Token Endpoint	The endpoint used by the application to exchange an authorization code for Access Tokens and ID Tokens.
UserInfo Endpoint	The endpoint that returns additional user profile information after authentication.
JWKS Endpoint	The endpoint that exposes Fixiam's public signing keys. Applications use these keys to verify the signature of ID Tokens.
Client Secret	A confidential credential generated by Fixiam that is used together with the Client ID to authenticate confidential clients. Keep this value secure and do not expose it publicly.

Best Practices

Use a unique Client ID for every application.
Ensure the Redirect URL exactly matches the callback URL configured in your application.
Configure only trusted logout URLs.
Select a Subject that uniquely identifies each user and does not change over time.
Configure token expiry values according to your organization's security requirements.
Enable Client Credential Grant only for applications that require machine to machine authentication.
Configure Attribute Mapping to include all claims required by your application.
Use the Discovery Endpoint whenever your application supports automatic OpenID Connect discovery.
After configuring the application, assign it to a group and add a test user before testing the integration.
Verify the integration with a test account before making the application available to end users.

Common OIDC Claims

The following claims are commonly used by OIDC applications.

Claim	Description
sub	A unique identifier for the authenticated user.
email	The user's email address.
preferred_username	The user's preferred username.
given_name	The user's first name.
family_name	The user's last name.
name	The user's full display name.
groups	The groups or roles assigned to the user, if configured.