WeftID 1.12 adds OpenID Connect identity providers. Until now, WeftID federated to upstream providers over SAML only. It can now consume OIDC providers the same way, so a tenant can sign users in through Keycloak, Auth0, Google Workspace, Microsoft Entra ID, or any spec-compliant OIDC provider.
WeftID 1.11 made WeftID an OpenID Provider, so applications could sign in with WeftID. This release is the other direction. WeftID now sits on both sides of the OIDC relationship: a relying party toward the providers it federates to, and a provider toward the applications it protects.
SAML and OIDC are peers. A tenant can run connections of both kinds at once, and each connection is independent. OIDC is the natural choice for a provider that ships it natively, or where exchanging a client ID and secret is easier than exchanging a signing certificate.
What it does
A connection starts from a provider preset. Google Workspace and Microsoft Entra ID presets pre-fill the issuer, scopes, and the claim WeftID correlates on. A generic preset covers Keycloak, Auth0, and everything else that publishes a discovery document. A provider that publishes no discovery document can be configured by entering its endpoints by hand.
Sign-in uses the authorization code flow with PKCE and nothing else. WeftID verifies the ID token against the provider's published keys, then correlates the user on a stable subject claim rather than on email, so an email change upstream does not produce a duplicate account. Name and email claims map onto WeftID's standard user attributes, with the mapping editable per connection. A user who does not exist yet is provisioned on first sign-in.
The rest of the directory treats an OIDC connection exactly like a SAML one. An email domain can be routed to an OIDC connection the same way it can to a SAML IdP, with one provider per domain across both protocols. A connection can also require WeftID's own two-step verification after the upstream provider has authenticated the user, for tenants that do not want to rely on the provider's authentication alone.
Client secrets are encrypted at rest and never displayed again after they are saved. Linking an upstream identity to an existing WeftID account by email is off by default, and requires the provider to assert the email as verified when it is turned on.
Getting it
Open Identity Providers > OIDC, add a connection, and pick a preset. Register the connection's redirect URI with the provider, enter the client ID and secret, test the connection, and enable it. The OIDC setup guide covers the mechanics, with vendor walkthroughs for Google Workspace and Microsoft Entra ID.
Also in 1.12
The admin navigation is restructured around concepts instead of permissions. The Admin wrapper is gone; Directory, Identity Providers, Applications, Security, Audit, and Settings are top-level sections, and SAML and OIDC providers sit as sibling tabs under Identity Providers. Every old URL redirects to its new location.
2.0 took both OIDC directions through the OpenID Foundation conformance suite. Social sign-in on the same OIDC connector and Google Workspace directory sync are on the roadmap.