Skip to content
Docs
Voxbi Cockpit APIs
API Guides

Identity providers

An identity provider lets you configure a generic OpenID Connect (OIDC) authentication service (such as Active Directory Federation Services (ADFS), Okta, or Keycloak) for a PBX, so your users can sign in to Cockpit with their existing corporate account through Single Sign-On. For Microsoft Entra ID, use the dedicated Microsoft SSO type instead of configuring an identity provider here.

Overview

Identity providers use OpenID Connect (OIDC) to delegate authentication to services such as Active Directory Federation Services (ADFS), Okta, or Keycloak. Once configured, users on the associated PBX can authenticate through their existing organization account instead of a separate password. Each PBX has a single identity provider. (Microsoft Entra ID has its own dedicated Microsoft SSO type, so it does not need an identity provider configured here.)

What it does

Cockpit acts as an OIDC relying party. When a user chooses SSO login, Cockpit redirects them to the provider's authorization endpoint, exchanges the resulting code for tokens, and retrieves the user profile from the userinfo endpoint. Pasting the discovery URL auto-fills these endpoints from the provider's well-known configuration document, so you rarely need to enter them by hand.

See also

  • PBX instances - each identity provider is scoped to a single PBX.

Form fields

Fields available in the create and edit forms.

IDP configuration

Name

Descriptive label for this provider, shown in lists and on the login screen.

Comment

Internal notes for your own reference. Not shown to users.

Client ID

The OAuth 2.0 client ID issued by your identity provider.

Client secret

The OAuth 2.0 client secret. Stored securely and not displayed after saving.

Discovery URL

The OIDC well-known discovery endpoint. If set, the authorization and token endpoints are discovered automatically from it. If you do not have a discovery endpoint, leave this empty and set the authorization and token URLs manually. Provide either this or the authorization and token URLs.

Authorization URL

The OAuth 2.0 authorization endpoint. Required only when no discovery URL is set.

Token URL

The OAuth 2.0 token endpoint. Required only when no discovery URL is set.

Userinfo URL

The OIDC userinfo endpoint for retrieving user profile data. Optional; if empty, user information is read from the ID token.

Issuer

Expected token issuer value used to validate tokens. Optional; resolved from the discovery URL when available.

Updated