OIDC discovery

Discover a provider

Any standards-compliant OpenID Connect provider can be turned into a Vestibule strategy from its issuer URL. oidc.discover reads the provider’s /.well-known/openid-configuration document and returns a ready-to-use strategy.

import vestibule/oidc

let assert Ok(strategy) = oidc.discover("https://accounts.google.com")

The discovered strategy plugs into the same two-phase flow, registry, and vestibule_wisp or vestibule_mist middleware as the dedicated provider packages.

Self-hosted providers

Because oidc.discover only needs an issuer URL, self-hosted providers such as Pocket ID work the same way. Point discover at your instance’s base URL and pair the resulting strategy with a config.new holding your client credentials.

import vestibule
import vestibule/config
import vestibule/oidc

// Discovery reads https://your-pocket-id-instance/.well-known/openid-configuration
let assert Ok(strategy) = oidc.discover("https://your-pocket-id-instance")
let client_config =
  config.new(
    client_id: "your-client-id",
    redirect_uri: "http://localhost:8000/auth/oidc/callback",
    auth: config.ClientSecret("your-client-secret"),
  )

let options = config.authorize_options()
let assert Ok(auth_request) =
  vestibule.create_authorization_request(
    strategy,
    config: client_config,
    options: options,
  )

Register a client

Register a client in your provider before discovery can be used end to end:

• Redirect URI — must exactly match the one passed to config.new (for example https://app.example.com/auth/oidc/callback). Production redirect URIs and OIDC issuers must use HTTPS; http://localhost and http://127.0.0.1 are permitted for local development only.

• Scopes — request openid email profile so Vestibule can populate the user’s id, email, and name. user_info.email only returns a value when the provider reports email_verified.

• Client credentials — copy the issued client ID and secret into config.new.