Skip to main content
Ragen can let people sign in with their company account through one OpenID Connect provider. That covers Microsoft Entra ID, Google Workspace, Keycloak, and any other issuer that publishes a discovery document. Company sign-in is part of the open edition, and it stays off until you configure it. Email-and-password and magic-link sign-in keep working alongside it.

​
What you need from the identity provider

Register Ragen as an application (Entra ID calls this an app registration, Google calls it an OAuth client) with:
  • Redirect URI: <BETTER_AUTH_URL>/api/auth/callback/oidc, for example https://ragen.example.com/api/auth/callback/oidc
  • Scopes: openid, email, profile
  • A client ID and a client secret

​
Configuration

Set these on the web app:
Use your tenant id, not common or organizations. A multi-tenant issuer vouches for accounts outside your company. Set OIDC_TRUST_EMAIL=true only when your tenant owns every domain in OIDC_ALLOWED_DOMAINS.
Restart the web app after changing these. A partial configuration turns company sign-in off and shows on the setup checklist on the sign-in page. Password sign-in is never affected.

​
Who gets in

  • Domain. Ragen refuses any address outside OIDC_ALLOWED_DOMAINS before it creates or links an account, and sends the person back to sign-in with an error. The match is exact: sub.example.com is not example.com.
  • Existing accounts. If someone already has a password account with the same address, the company sign-in links to it only when the issuer reports the address as verified, and only for an allowed domain. An issuer that does not own your domain cannot take over a local account by claiming its address.
  • Tokens. Ragen verifies the ID token against the issuer’s published keys, and uses PKCE.

​
Where new users land

With OIDC_JOIN_ORGANIZATION set, a person signing in for the first time becomes a member of that organization, even when registration is closed. The identity provider and the allowed domains decide who that is, and an administrator promotes members as usual. This only applies when the address is verified, either by the issuer or by OIDC_TRUST_EMAIL. If the organization you name does not exist, the sign-up is refused. Without OIDC_JOIN_ORGANIZATION, company sign-in works like the other sign-up methods. It needs registration to be open, or an invitation, and each new user gets an organization of their own.

​
When something goes wrong

SAML, SCIM directory sync, and MFA are not built yet. See the roadmap.