Update: I switched the identity provider from Auth0 to Logto (OIDC) in the same ODC Personal environment, using the same setup steps, and login now works. So custom OIDC providers do work in Personal edition. The 502 on /auth/realms/.../broker/.../endpoint only happened with Auth0, even though Auth0 logged a successful code exchange. I never found the root cause, so if anyone knows what makes ODC fail with Auth0, I'd still like to hear it.
Hi all,
I'm building a proof of concept in an ODC Personal environment and trying to use Auth0 as an external OpenID Connect identity provider for end users (App authentication). Login fails with a 502 after Auth0 authenticates the user.
What I did
- Auth0 application type: Regular Web Application
- ODC Portal > Manage > Identity providers > Add provider > OpenID Connect
- Discovery endpoint: https://<my-tenant>.us.auth0.com/.well-known/openid-configuration (Get Details worked)
- Client ID and Client secret from the Auth0 application
- Scopes: openid, email, profile
- Username and Email claim mapping: email
- Organization user email verification: Trust all user emails as verified
- Authentication method: client_secret_post
- Tried PKCE SHA-256 and None, same result
- Allowed Callback URLs in Auth0: the Login URL under "Apps in Development" from the Redirect URLs tab
- Provider assigned under App authentication
- The user already exists in ODC Portal with the same email, and is active
What happens
- Auth0 logs show a successful exchange of the authorization code for an access token (event type seacft) for the same attempt, so the Auth0 side works.
- Then the browser request to
https://<my-tenant>-dev.outsystems.app/auth/realms/<realm-id>/broker/<broker-id>/endpoint?code=...&state=...&iss=...
returns HTTP 502.
- The page shows: "Unexpected error when authenticating with identity provider".
- Nothing useful appears in ODC Portal > Monitor > Logs.
Questions
1. Does the Personal edition support a custom OIDC identity provider such as Auth0, or only the built-in providers?
2. If it is supported, is there any known cause for a 502 on the /broker/.../endpoint step, and where can I see the underlying error?
Thanks in advance.