OIDC

At a glance — per-organization identity sources that org admins add in the UI (not in env). Each is built lazily per login, so changes take effect across replicas with no restart and boot never depends on an IdP being up.

Backend prerequisites

OIDC needs two backend settings configured once by the operator:

Variable	Why
`GANTRYCD_BACKEND_PUBLIC_BASE_URL`	builds the callback URL
`GANTRYCD_DATA_ENCRYPTION_PROVIDER` (+ its key)	encrypts each source’s client secret at rest — see Secret encryption

Configure (per org)

Admins add a source under Settings → Identity Sources, giving the issuer URL and client credentials. GantryCD validates the issuer’s .well-known document synchronously at save time, so a typo fails immediately.

An org can have multiple OIDC sources (e.g. one for staff, one for contractors). They’re isolated by issuer, so a group from one tenant never grants access through another.

Access rules

{"type": "oidc_group", "group": "engineers"}

OIDC groups are flat strings — no nesting.

Troubleshooting

“discovery failed” — the issuer must be reachable from the backend and serve valid .well-known/openid-configuration JSON (trailing slash matters per IdP).
“not configured on this instance” — set GANTRYCD_BACKEND_PUBLIC_BASE_URL.
encryption-key error — set GANTRYCD_DATA_ENCRYPTION_PROVIDER and its key (for aes-256, GANTRYCD_DATA_ENCRYPTION_AES_256_KEY_B64, base64 32 bytes).

Internals

Per-tenant isolation and the lazy-build path are in SSO Configuration.