Okta, Google, and generic OIDC

Tenvyr supports Microsoft Entra ID, Okta, Google, and standards-compatible generic OIDC providers.

Shared requirements

Every provider needs:

• a client ID and client secret;
• an issuer or provider-specific tenant identifier;
• a web redirect URI using the Tenvyr provider UUID; and
• an immutable subject (sub) for each person.

The redirect URI is:

https://app.tenvyr.com/auth/v1/oidc/PROVIDER_UUID/callback

Create the provider in Tenvyr, copy its UUID, and then add the exact URI to the identity provider.

Provider choices

Okta

Use an Okta OIDC web application. Enter the Okta issuer for the intended authorization server, plus the client ID and secret. Assign a pilot group before enabling broader access.

Google

Use a Google OAuth web client. Restrict the application to the intended Workspace organization where appropriate, and add the Tenvyr callback as an authorized redirect URI.

Generic OIDC

Use the provider's issuer URL. It must expose standards-compatible discovery, authorization, token, and signing-key endpoints over HTTPS. Qualify issuer and subject stability, key rotation, logout behavior, and cloud boundary before production use.

Safe rollout

1. Keep a local Tenvyr owner account available.
2. Limit provider assignment to pilot users.
3. Confirm iss and sub remain stable across normal profile changes.
4. Test login, Tenvyr MFA, logout, and disabled-user behavior.
5. If SCIM is available, test immutable external-ID matching before enabling first-sign-in provisioning.

Tenvyr never links accounts solely because their email addresses match.