Skip to main content

​
OAuth / OIDC Sign-in

Novaplan AI can connect to an OAuth 2.0 or OpenID Connect identity provider that exposes the authorization, token, and user-info endpoints needed below and returns a usable email identity. Use this method when your provider has no dedicated page; Okta, Auth0, Keycloak, Authentik, Ping, and self-hosted providers are examples to configure and test with your administrator. If you use Google or Microsoft, configure those directly instead: Google, Microsoft / Azure AD. They need less setup.

​
How it works

  1. Someone selects your provider’s button on the Novaplan AI sign-in page.
  2. Novaplan AI sends them to your provider’s authorisation URL.
  3. They sign in there and approve the request.
  4. Your provider redirects back to Novaplan AI with a code, which Novaplan AI exchanges for a token.
  5. Novaplan AI reads their identity from the user info endpoint and signs them in.

​
Before you start

You need administrator access to both Novaplan AI and your identity provider. Decide first whether people without a Novaplan AI account should be able to create one by signing in. That is controlled by Enable JIT provisioning, described below, and it is the single most important choice on this page.

​
Step 1: Register Novaplan AI with your provider

Create an application (your provider may call it a client, an app integration, or a relying party) and set its redirect URI to:
Replace your-workspace.example.com with the actual address people use to reach Novaplan AI. Novaplan can provide the correct workspace address. Use the exact redirect URI displayed in the Novaplan AI configuration panel. Then note these values from your provider, which you will need in the next step:
  • Client ID and client secret
  • Authorization URL
  • Token endpoint
  • User info endpoint
Most OpenID Connect providers publish the three URLs at https://your-provider/.well-known/openid-configuration. Fetching that document is usually quicker than hunting through the console:

​
Step 2: Configure Novaplan AI

Go to Workspace settings → Authentication and add the OAuth method.
Provider Name, Client ID, Client Secret, Authorization URL, Token Endpoint and User Info Endpoint are all required. Scope and JIT provisioning are optional.Novaplan AI uses a confidential client: the authorisation code is exchanged for a token server-side using the client secret, so a public client with PKCE and no secret will not work here.
Keep the client secret confidential. The sign-in page needs the client ID and authorisation URL; the token exchange uses the client secret server-side. Register the exact redirect URI with your identity provider so an authorisation code cannot be redirected elsewhere. Do not use a wildcard redirect URI.

​
Just-in-time provisioning

JIT provisioning is on by default for this method. With it on, anyone who can authenticate at your identity provider gets a Novaplan AI account the first time they sign in, without an invitation. Novaplan normally creates the workspace and invites its users. To keep access invitation-based, turn JIT provisioning off when configuring this method, then test that an invited user can sign in and an uninvited user cannot. Coordinate this setting with Novaplan before enabling the method.
If your identity provider is open to a wider audience than Novaplan AI should be — a shared corporate tenant, a provider that permits self-registration, or a social login — turn JIT provisioning off. Otherwise anyone able to sign in at the provider can create their own Novaplan AI account.With JIT off, someone without an existing Novaplan AI account is refused with “Account not found. Please contact your administrator.” You invite people first, and sign-in matches them by email.
Turn JIT on when your identity provider already contains exactly the people who should have access. Turn it off when access to Novaplan AI should be narrower than access to the provider.

​
Step 3: Test before you rely on it

  1. Save the configuration.
  2. Open Novaplan AI in a private browsing window so you are not signed in.
  3. Select your provider’s button and complete sign-in.
  4. Confirm you land in Novaplan AI, and check that the account was created or matched as you intended.
Keep an administrator recovery method available until you have confirmed OAuth works. If the provider configuration is wrong, that method lets an administrator fix it.

​
Troubleshooting

redirect_uri_mismatch. The redirect URI registered with your provider does not exactly match the one Novaplan AI uses. It must match on scheme, host, port and path. http versus https and a trailing slash both count as a mismatch. “Account not found. Please contact your administrator.” Sign-in worked, but no Novaplan AI account matches and JIT provisioning is off. Either invite the person first, or turn JIT on if that suits your access model. Sign-in succeeds and then returns to the login page. Novaplan AI could not read an identity from the user info endpoint. Check that the endpoint is correct and that your scope includes openid email profile, or whatever your provider requires to return an email address. The button does not appear. The method is configured but not enabled for the organisation. Check Workspace settings → Authentication and confirm OAuth is in the list of allowed methods.