Skip to content

Update multi-domain support: OIDC SSO #11270

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Karuna-Mendix wants to merge 3 commits into
base: development
Choose a base branch
from
Open

Update multi-domain support: OIDC SSO #11270

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5df3874
Update multi-domain support
Karuna-Mendix May 29, 2026
3ca2026
small fix
Karuna-Mendix May 29, 2026
574726e
Update version specific info
Karuna-Mendix May 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions content/en/docs/marketplace/platform-supported-content/modules/oidc.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,7 @@ This section provides an overview of updates for the OIDC SSO module across diff

| Mendix Version | OIDC SSO Module Version | Important Migration Changes | Additional Information |
| --- | --- | --- | --- |
| 10.24.0 and above | 4.x.x | - | Supporting multi-domain using constant. See [Configuring Multi-Domain](#multi-domain) for more information. |
| 10.24.0 and above | 4.4.0 | Move the `Encryption.Encryptionkey` value to the `OIDC.Encryptionkey` constant. | Dependencies on the Encryption and Nanoflow Commons modules have been removed. <br> **Issued Tokens** tab has been removed from the OIDC Client Configuration page. |
| 10.24.0 and above | 4.3.0 | - | Supporting multi-domain and sub-path. |
| 10.24.0 and above | 4.2.1 | In version 4.2.1, automatic migration of the UserCommons has been removed. | Since migration steps were removed in 4.2.1, you must upgrade to OIDC SSO version 4.2.0 first to prevent data loss. This applies to the UserCommons, if you are migrating from any version below 3.0.0, always upgrade to 4.2.0 first, then move to the latest v4.2.1. |
Expand Down Expand Up @@ -521,6 +522,20 @@ Example: `OIDC.Default_SAM_TokenProcessing_CustomATP`
When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration.
{{% /alert %}}

## Configuring Multi-Domain {#multi-domain}

The OIDC SSO module supports multi-domain, enabling flexible deployment in multi-app or shared domain environments. When you enable multi-domain support, the module resolves the application URL from request headers rather than relying solely on the ApplicationRootUrl, allowing users to access the application through their custom domains.

To enable multi-domain support, set the `EnableMultiDomainSupport` constant to *True* in the [Acceptance Environment Details](/developerportal/deploy/environments-details/#constants) for Mendix Cloud. By default, this constant is set to *False*.

After enabling multi-domain support, configure the `AllowedHosts` constant to specify which custom domains are permitted. If you enable multi-domain support but leave `AllowedHosts` empty, the module redirects all users to the ApplicationRootUrl.

The `AllowedHosts` constant accepts a comma-separated or space-separated list of hostnames in the following formats:

* Exact match – `example.com` allows only that specific domain
* Subdomain wildcard – `.example.com` allows any subdomain of `example.com`
* Full wildcard – `*` allows any domain

## User Provisioning (End-User Onboarding)

Initially, your app will not have any end-users. You can onboard end-users into your app using one of the following mechanisms:
Expand Down