OpenID Connect (SSO)

Sign users in at the gateway against an identity provider, and pass who they are to the app.

Type	oidc
Category	Access
Requires	Goma Gateway 0.14.0 or newer

Gateway version

A route using this middleware fails to load on a gateway older than 0.14.0. Miabi does not read the running gateway's version, so nothing stops you saving it — the route is what reports the problem.

Fields

Field	Type	Required	Default	Description
issuer	text	no	—	The provider's issuer. Everything else is discovered from it, so the endpoints below are only for a provider without a discovery document. Example: https://id.example.com/application/o/app/.
clientId	text	yes	—	Client ID.
clientSecret	text	yes	—	Client secret. Secret — encrypted at rest, never returned by the API.
provider	one of custom, google, github, gitlab, amazon, facebook	no	—	A well-known provider fills in its own endpoints.
scopes	list of text	no	—	Requested scopes. Most providers need at least openid, email and profile. Example: openid.
audience	text	no	—	Enforced as the aud claim on JWT access tokens. The ID token is always checked against the client ID.
endpoint	group	no	—	Only needed without an issuer, or to override what discovery returns.
callbackPath	text	no	—	Where the provider returns the user. Register this exact path with the provider. Defaults to the route path plus /oauth2/callback. Example: /oauth2/callback.
logoutPath	text	no	—	Ends the session when requested. Not served unless set. Example: /oauth2/logout.
postLoginRedirect	text	no	—	Empty returns the user to the page they asked for. Example: /dashboard.
postLogoutRedirect	text	no	—	After sign-out. Example: /.
pkce	true/false	no	true	Proof key on the code exchange. Leave on unless the provider rejects it.
session	group	no	—	Session.
claimsExpression	text	no	—	Who is allowed in once signed in. Users who do not match get 403. Example: Contains('groups', 'engineering').
claimsSource	list of text	no	—	Where claims are read from, in increasing precedence: access_token, userinfo, id_token. Example: id_token.
forward	group	no	—	Send identity to the app.

endpoint

Only needed without an issuer, or to override what discovery returns.

Field	Type	Required	Default	Description
authUrl	text	no	—	Authorization URL.
tokenUrl	text	no	—	Token URL.
jwksUrl	text	no	—	Verifies JWT access tokens and ID tokens.
userInfoUrl	text	no	—	Verifies opaque tokens, and supplies claims.

session

Field	Type	Required	Default	Description
store	one of cookie, memory, redis	no	—	Cookie needs no shared state. Redis shares sessions across gateway replicas and needs Redis configured on the gateway.
secret	text	no	—	Keys the sealing of session data. Defaults to the client secret; changing it signs everyone out. Secret — encrypted at rest, never returned by the API.
ttl	duration (e.g. 10m)	no	—	How long a session lives regardless of activity. Example: 12h.
idleTimeout	duration (e.g. 10m)	no	—	Idle timeout. Example: 1h.
cookie	group	no	—	Cookie.

session.cookie

Field	Type	Required	Default	Description
name	text	no	—	Name. Example: goma_session.
path	text	no	—	Defaults to the route path, so two routes on one host do not share a session. Example: /.
domain	text	no	—	Domain.
sameSite	one of lax, strict, none	no	—	Strict breaks the provider's callback redirect.
secure	true/false	no	—	Defaults to whether the request arrived over TLS.

forward

Field	Type	Required	Default	Description
headers	key/value map	no	—	Dot notation reaches nested claims; a template like "{{ .given_name }} {{ .family_name }}" joins several.
query	key/value map	no	—	Claims as query parameters.
cookies	key/value map	no	—	Added to the request sent upstream, never to the browser's response.
stripInbound	true/false	no	true	Leave on. Off lets a caller send these headers itself and choose who your app thinks it is.
arraySeparator	text	no	—	Array separator. Example: ,.
encoding	one of auto, raw	no	—	Auto base64-encodes non-ASCII values, which headers cannot carry, and flags them.
maxValueBytes	number	no	—	Maximum value size. Example: 4096.
accessTokenHeader	text	no	—	Lets the app verify the token itself instead of trusting a header. Example: Authorization.
idTokenHeader	text	no	—	Forward the ID token. Example: X-Auth-Id-Token.

Secret fields

Fields marked secret are encrypted at rest and never returned by the API. Editing the middleware leaves a stored secret in place unless you type a new value — an empty box means "keep what is stored", not "clear it".