Skip to main content

OpenID Connect


NLX Management uses the OpenID Connect (OIDC) protocol to authenticate users, which is configured through a number of environment variables:


When the management API starts, it will fetch the OIDC configuration from ${OIDC_DISCOVERY_URL}/.well-known/openid-configuration and use this metadata to configure the OIDC client.

Configuration hints for providers

There are multiple applications and cloud providers that offer OIDC. Below are configuration hints for OIDC providers that have been used successfully with NLX.


Dex is a federated OIDC provider.

Assuming Dex is deployed on, the discovery url is:


Azure Active Directory

Azure Active Directory is a cloud-hosted identity provider from Microsoft, part of Azure webservices.

To use AAD as OIDC provider, you must obtain:

  • Tenant ID, which is usually a UUID4
  • Application (client) ID
  • Application secret value

And the correct callback URL must be provided:

The tenant ID is used in the discovery URL:


You can inspect the metadata document in your browser at${tenantId}/v2.0/.well-known/openid-configuration

Known issues:

  • The v2.0 is essential, since the URL without the suffix has an invalid issuer which doesn't match the tenant-specific URL.
  • Make sure there's no trailing slash - the issuer does not have one.