Concepts
OAuth and OpenID Connect, explained simply
A plain-English guide to sign-in providers, OAuth, OpenID Connect, and the settings you see in Verentis.
OAuth and OpenID Connect help you sign in without giving every app your password. They let Verentis trust a sign-in service you already use.
Think of a hotel. You show your ID at the front desk. The front desk checks who you are and gives you a key card. You do not show your passport to every door in the hotel. The doors only need to trust the key card.
The problem OAuth solves
Without a sign-in standard, every website would need to store its own password for you. That is risky and tiring.
OAuth 2.0 gives apps a safer way to ask a trusted service for limited access. OpenID Connect uses OAuth 2.0 for sign-in.
A second analogy is a doorman. The doorman checks your ID. Once the doorman is satisfied, they tell the building, "This person may come in." The building does not need to inspect your ID itself.
Identity provider
An identity provider, often shortened to IdP, is the trusted service that signs people in.
Examples include Microsoft Entra, Google, Auth0, and Keycloak.
In Verentis, sign-in uses an identity provider. By default, Verentis uses Microsoft Entra External ID. A workspace can also connect its own provider on the workspace OAuth settings page.
OpenID Connect
OpenID Connect, often shortened to OIDC, is the modern sign-in standard built on OAuth 2.0.
OIDC answers two simple questions:
- Who is this person?
- What basic profile information may the app know, such as name or email address?
OAuth is the base system. OIDC adds the sign-in layer.
Words you see on the OAuth settings screen
Authority or issuer URL
The authority or issuer URL is the provider's base web address. It is where sign-in begins.
It tells Verentis, "This is the trusted provider for this workspace."
Client or application
A client or application is the registered app that represents Verentis inside your identity provider.
It is like adding Verentis to the provider's guest list.
Client ID
The client ID is the public name for that registered app.
It is not secret. It helps the provider know which app is asking for sign-in.
Client secret
The client secret is a password-like value for the registered app.
It proves the app is genuine. Keep it safe. Do not paste it into chat, email, or public files.
Redirect URI or callback URL
The redirect URI, also called a callback URL, is the address the provider sends you back to after sign-in.
In Verentis, this is the workspace's web address.
Scopes
Scopes describe the information Verentis asks for.
Common OIDC scopes are:
openid: lets the provider sign you in.profile: lets Verentis receive basic profile details, such as your name.email: lets Verentis receive your email address.
Scopes are like the questions Verentis is allowed to ask the provider.
What happens when you click Sign in
You are sent to the provider
Verentis sends your browser to the identity provider. This is where you enter your sign-in details.
You authenticate
To authenticate means to prove who you are. You might type a password, use a passkey, or approve a prompt on your phone.
The provider sends you back with a token
A token is a short-lived digital note from the provider. It says the provider has checked you.
Verentis signs you in
Verentis checks the token. If it is valid, Verentis creates your Verentis session and lets you continue.
Connect this idea to the settings page
Now that you know the words, you can use the workspace OAuth settings page to connect your provider.