> For the complete documentation index, see [llms.txt](https://help.novacuraflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.novacuraflow.com/6.11/development/flow-studio/installation-and-login/malin-test-test.md).

# OpenID connect

OpenID Connect is an identity layer on top of the OAuth 2.0 protocol. It allows Clients to verify the identity of the end user based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the end user.

## Set up Studio

### **Requirements**

![](/files/-LvGThbJZIXRcshYZP9X)

OpenID Connect is enabled in the Flow Studio.

1. Go to Environment -> OpenID Connect and select Enable.
2. Enter the configuration.
3. Save.

{% hint style="info" %}
When saving configuration, you will need to restart your IIS for the changes to take effect.
{% endhint %}

When OpenID is enabled the normal username/password login is disabled in the mobile clients (iOS, Android) and Windows client.

OpenID login will work for both synchronized users and manually entered users.

### **Configuration**

* **Authority address:** Base URL for the identity provider
* **Client ID:** Unique id for your application. Created in admin part of your identity provider.
* **Scope:** OpenID Connect scopes are used by an application during authentication to authorize access to a user's details, like name and picture. Each scope returns a set of user attributes, which are called claims. Some IdPs require special scopes, for example when using Azure AD you must include the ?user.read? scope.
* **Authentication flow:** Hybrid or Authorization Code. 

{% hint style="info" %}
Hybrid is not supported for Universal Windows Client.
{% endhint %}

* **Do not require authorization code hash:** Check this for compatibility with certain IdPs. (Azure needs this checked)
* **Do not require access token hash:** Check this for compatibility with certain IdPs. (Azure needs this checked)
* **Do not validate discovery endpoints:** Check this for compatibility with certain IdPs. (Azure needs this checked)
* **Do not validate issuer name:** Check this for compatibility with certain IdPs. (Azure needs this checked)
* **Username - Claim mapping key:** The name of the claim from where to extract the flow user name. IdP specific. Example: email, upn, unique\_name.
* **Exclude domain:** Check this if the flow user in synchronized or entered without domain.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.novacuraflow.com/6.11/development/flow-studio/installation-and-login/malin-test-test.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.