User Provisioning (OIDC)

Documentation Index

Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

• Single sign-on (SSO) via OAuth 2.0 / OIDC with JWKS-based JWT validation
• Automatic role assignment using custom claims, app roles, or group-to-role mappings
• Team synchronization from IdP groups into Bifrost teams
• Business unit mapping from IdP attributes to Bifrost business units
• Bulk user provisioning with filter-preview before import
• Background lifecycle reconciliation every 24 hours for imported users
• OIDC session refresh checks every 15 minutes to confirm users are still active with the IdP
• Silent token refresh using server-stored refresh tokens when the user remains active

​

Supported Identity Providers

​

How it works

1. Login - Bifrost redirects unauthenticated users to the provider’s authorization endpoint (Authorization Code flow).
2. Token exchange - on callback, Bifrost exchanges the code for an access token and refresh token, stores them in an HttpOnly cookie / server session, and validates the JWT against the provider’s JWKS.
3. Identity extraction - configurable JWT claims (userIdField, rolesField, teamIdsField) are mapped to a Bifrost user, role, and teams. Provider-specific app roles or custom attributes override claim lookup.
4. Attribute mapping - optional attributeRoleMappings, attributeTeamMappings, and attributeBusinessUnitMappings translate arbitrary claim values (e.g., a department string or Okta group name) into Bifrost roles, teams, or business units.
5. Session refresh checks - every 15 minutes, Bifrost refreshes the OIDC session. If the session cannot be refreshed, Bifrost checks with the OIDC server whether the user is still active.
6. Background reconciliation - Bifrost periodically calls the configured provider’s directory APIs to reconcile imported users and mapped roles, teams, and business units.
7. Bulk import - admins can preview users matching a filter and bulk-import them via the dashboard, which calls the provider’s user directory API.
8. Daily sync - Bifrost reconciles imported users every 24 hours.
9. Decommissioning - if the OIDC server reports that a user is no longer active, or the 24-hour reconciliation no longer finds them in the active source set, Bifrost decommissions that user locally.

​

Capabilities

​

Background lifecycle reconciliation

​

Configuration reference

{
  "scim_config": {
    "enabled": true,
    "provider": "okta | entra | zitadel | keycloak | google",
    "config": {
      "...": "provider-specific fields - see each IdP guide"
    }
  }
}

​

Environment variable support

​

Okta

​

Microsoft Entra ID

​

Keycloak

​

Zitadel

​

Google Workspace

​

Configuring from the dashboard

1. Navigate to Governance → User Provisioning in the Bifrost dashboard.
2. Select your identity provider from the OIDC Provider dropdown.
3. Fill in the provider-specific fields. Required fields are marked and validated on Verify.

4. Click Verify to test credentials end-to-end. Bifrost will reach the provider’s JWKS / directory endpoint and report any failures.
5. Configure Attribute → Role / Team / Business Unit mappings as needed.
6. Toggle Enabled and click Save Configuration.

​

Attribute mappings

{
  "attribute": "department",
  "value": "Engineering",
  "role": "developer"
}

• Role mappings - first match wins. Set a fallback with "attribute": "*" at the end.
• Team mappings and business unit mappings - all matching rules apply, so a user with department=Platform and group=sre can be placed on multiple teams.

​

Bulk user provisioning

1. Go to Governance → User Provisioning → Import Users.
2. Select a filter - groups, roles, departments, or a custom query depending on provider support.
3. Click Preview to see up to 50 matching users.
4. Click Import to create them in Bifrost with role / team / BU assignments applied.

​

Troubleshooting

​

Related

• Role-Based Access Control - permissions model and custom roles
• Advanced Governance - budgets, limits, and compliance
• Audit Logs - track authentication events and role changes