diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md index 0be40ae616f..f6e6dd2bafc 100644 --- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md +++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md @@ -205,6 +205,7 @@ This section provides an overview of updates for the OIDC SSO module across diff | Mendix Version | OIDC SSO Module Version | Important Migration Changes | Additional Information | | --- | --- | --- | --- | +| 10.24.0 and above | 4.x.x | - | Supporting multi-domain using constant. See [Configuring Multi-Domain](#multi-domain) for more information. | | 10.24.0 and above | 4.4.0 | Move the `Encryption.Encryptionkey` value to the `OIDC.Encryptionkey` constant. | Dependencies on the Encryption and Nanoflow Commons modules have been removed.
**Issued Tokens** tab has been removed from the OIDC Client Configuration page. | | 10.24.0 and above | 4.3.0 | - | Supporting multi-domain and sub-path. | | 10.24.0 and above | 4.2.1 | In version 4.2.1, automatic migration of the UserCommons has been removed. | Since migration steps were removed in 4.2.1, you must upgrade to OIDC SSO version 4.2.0 first to prevent data loss. This applies to the UserCommons, if you are migrating from any version below 3.0.0, always upgrade to 4.2.0 first, then move to the latest v4.2.1. | @@ -521,6 +522,20 @@ Example: `OIDC.Default_SAM_TokenProcessing_CustomATP` When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration. {{% /alert %}} +## Configuring Multi-Domain {#multi-domain} + +The OIDC SSO module supports multi-domain, enabling flexible deployment in multi-app or shared domain environments. When you enable multi-domain support, the module resolves the application URL from request headers rather than relying solely on the ApplicationRootUrl, allowing users to access the application through their custom domains. + +To enable multi-domain support, set the `EnableMultiDomainSupport` constant to *True* in the [Acceptance Environment Details](/developerportal/deploy/environments-details/#constants) for Mendix Cloud. By default, this constant is set to *False*. + +After enabling multi-domain support, configure the `AllowedHosts` constant to specify which custom domains are permitted. If you enable multi-domain support but leave `AllowedHosts` empty, the module redirects all users to the ApplicationRootUrl. + +The `AllowedHosts` constant accepts a comma-separated or space-separated list of hostnames in the following formats: + +* Exact match – `example.com` allows only that specific domain +* Subdomain wildcard – `.example.com` allows any subdomain of `example.com` +* Full wildcard – `*` allows any domain + ## User Provisioning (End-User Onboarding) Initially, your app will not have any end-users. You can onboard end-users into your app using one of the following mechanisms: