Drop-in identity federation with the five IAM brokers your enterprise already runs.

Keycloak OIDC v1 IdP

Keycloak's Identity Provider surface accepts an OIDC v1 provider natively. Everything below is admin-console clicks plus one JSON blob.

Prerequisite

Keycloak realm admin. One OIDC client registered on the CodeB tenant at /oidc-clients.html with the Keycloak broker callback allow-listed: https://<YOUR_KEYCLOAK>/realms/<REALM>/broker/codeb-eudi-wallet/endpoint

Steps

1. Realm settings -> Identity providers -> Add provider -> OpenID Connect v1.0.
2. Import from URL: https://<CODEB_TENANT_HOST>/.well-known/openid-configuration. Keycloak fills in the endpoints.
3. Fill in Client ID and Client Secret (issued at CodeB /oidc-clients.html).
4. PKCE = enabled, method S256. Client authentication = "client secret sent as post".
5. Default scopes: openid profile email.
6. Save. Optionally set an authenticator flow so this provider auto-fires for a specific email domain.

Config JSON (skeleton)

Download full JSON

Verify

Log out of Keycloak. Open a realm-protected app. The login page shows a "CodeB (EU Digital Identity Wallet)" button. Click - CodeB's picker appears. Complete any method. Keycloak creates the federated user and issues its own tokens.

Auth0 Custom Social Connection + Action

Auth0 has an OIDC-based "Custom Social Connection" that accepts any conformant IdP. Add CodeB as one of those, then attach the Post-Login Action below so CodeB-specific claims flow into the Auth0 profile.

Prerequisite

Auth0 tenant admin. One OIDC client registered on the CodeB tenant at /oidc-clients.html with the Auth0 callback allow-listed: https://<YOUR_AUTH0_DOMAIN>/login/callback

Steps

1. Auth0 Dashboard -> Authentication -> Enterprise -> Create Connection -> Custom Social Connection (OIDC).
2. Name it codeb-eudi-wallet. Set Issuer URL https://<CODEB_TENANT_HOST>. Auth0 discovers the rest via /.well-known/openid-configuration.
3. Client ID / Client Secret from CodeB. Scopes: openid profile email. PKCE: enabled, S256.
4. Enable the connection on the applications that should offer it.
5. Actions -> Library -> Build Custom -> Post-Login trigger. Paste the snippet below. Add it to the Login Flow.

Post-Login Action (JavaScript)

Download Action

Verify

Universal Login should now show a "Continue with CodeB" button. Click through, complete any method on CodeB's picker, land back in Auth0.

Okta OIDC IdP + Routing Rule

Okta's "Identity Providers" screen accepts a generic OIDC IdP. Add CodeB there, then a Routing Rule decides which users see it.

Prerequisite

Okta org "Super Administrator". One CodeB OIDC client with Okta's callback allow-listed: https://<YOUR_OKTA_DOMAIN>/oauth2/v1/authorize/callback

Steps

1. Security -> Identity Providers -> Add Identity Provider -> OpenID Connect IdP.
2. Fill in the CodeB endpoints (auth / token / JWKS / userinfo) or point at the discovery URL. PKCE required, S256.
3. Set "IdP Username" mapping to idpuser.email. "If no match found" -> Create new user (JIT).
4. Save. Then Security -> Identity Providers -> Routing Rules -> Add Rule. Route your target user population to the new IdP.
5. Add custom user attributes (codebRole, eudiVerified, walletAttestation) under Directory -> Profile Editor -> Identity Providers before you finish mapping.

Download full walk-through

Verify

Log out of Okta. Open your org sign-in page. The CodeB button appears - click through, complete any method, JIT-provision the Okta user.

Microsoft Entra ID External Identities

Entra's "External Identities" surface (formerly Azure AD B2C / B2B external IdP) accepts a custom OIDC provider. Configuration only; no Graph API calls.

Prerequisite

Entra role External Identity Provider Administrator (or higher). One CodeB OIDC client with the Entra callback allow-listed: https://login.microsoftonline.com/te/<ENTRA_TENANT_ID>/oauth2/authresp

Steps

1. Entra admin center -> External Identities -> All identity providers -> Custom -> New OpenID Connect provider.
2. Metadata URL: https://<CODEB_TENANT_HOST>/.well-known/openid-configuration. Scope: openid profile email. Response type: code. Response mode: query.
3. Map claims: User ID <- sub; Display name <- name; Email <- email.
4. Add the provider to the applicable User Flow so end users see it on sign-in.

Download full walk-through

Verify

Open the user flow in incognito. Click the CodeB button. Complete any method. Entra creates the external user and issues its own token.

AWS Cognito User Pool OIDC IdP

Cognito User Pools accept a generic OIDC identity provider. The JSON below is ready for aws cognito-idp create-identity-provider.

Prerequisite

AWS account admin. A Cognito User Pool with a hosted UI domain. Custom attributes custom:codeb_role, custom:eudi_verified, custom:wallet_attestation declared on the pool. One CodeB OIDC client with Cognito's callback allow-listed: https://<COGNITO_DOMAIN>/oauth2/idpresponse

Steps

1. Cognito console -> User Pool -> Sign-in experience -> Federated identity provider sign-in -> Add identity provider -> OpenID Connect (OIDC).
2. Provider name: CodeB. Client ID / Secret from CodeB. Scopes: openid profile email. Attribute request method: GET.
3. Issuer: https://<CODEB_TENANT_HOST>. Cognito auto-discovers the endpoints.
4. Map attributes per the JSON below. Save.
5. App integration -> App client settings -> enable "CodeB" under Enabled identity providers.

Config JSON

Download JSON

Verify

Hit https://<COGNITO_DOMAIN>/oauth2/authorize?identity_provider=CodeB&response_type=code&client_id=<APP_CLIENT_ID>&scope=openid+email&redirect_uri=<YOUR_APP>. Cognito redirects to CodeB's picker; on completion, back to your app callback with a Cognito-issued authorization code.