skills.rest
overlens
overlensOFFICIAL
Explore all skills by this author →
WebsiteGitHub

idp-use-oidc-discovery

Configure generic OIDC libraries against the Overlens IDP discovery document.

Updated Jul 24, 2026
Search Tags:#authentication#oauth#discovery#sso#oidc#nextauth#openid-client
One-click install
npx skills add https://github.com/overlens/claude-marketplace --skill idp-use-oidc-discovery-overlens
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: idp-use-oidc-discovery
Source: https://github.com/overlens/claude-marketplace/tree/main/plugins/idp-integration/skills/idp-use-oidc-discovery
Command: npx skills add https://github.com/overlens/claude-marketplace --skill idp-use-oidc-discovery-overlens

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Generic OIDC/OAuth libraries like Auth.js, openid-client, and passport-openidconnect fail out of the box against the Overlens IDP because its authorization endpoint returns JSON instead of a 302 redirect, and this Skill explains exactly how to adapt them. ## Core Features & Use Cases - Copy-paste recipes: Ready configurations for Auth.js (NextAuth), openid-client, and passport-openidconnect pointing at the Overlens discovery document. - Conformance-gap table: A precise list of where the IDP deviates from strict OIDC (JSON authorize responses, no nonce validation, string vs array aud, no prompt=none) and the workaround for each. - Use Case: You have an existing NextAuth app and want to add Overlens as a provider. Use this Skill to configure the wellKnown URL, set checks to pkce and state, and route the browser through the Accounts SPA instead of the lib-generated authorize URL. ## Quick Start Ask the assistant to configure Auth.js with the Overlens IDP using its OIDC discovery document.

Frequently Asked Questions about idp-use-oidc-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Auth.js or NextAuth with the Overlens IDP?▼

Set the provider's wellKnown URL to https://idp.overlens.com.br/.well-known/openid-configuration, use checks: ['pkce', 'state'] instead of nonce, and send the browser to the Accounts SPA login URL rather than the lib-generated authorize URL.

Why does openid-client fail against the Overlens IDP?▼

The Overlens authorization endpoint returns JSON instead of a 302 redirect, so libraries that send the browser to the authorization_endpoint never complete the flow. Redirect the browser to the Accounts SPA and use the library only for token exchange, refresh, and userinfo.

Is the Overlens IDP fully OIDC compliant?▼

No. It does not validate nonce, does not support implicit or hybrid flows, prompt=none, acr_values, or dynamic client registration. The back-channel endpoints (token, JWKS, userinfo, revocation) are fully standard.

Does the Overlens IDP support silent authentication with prompt=none?▼

The literal prompt=none parameter is not parsed, but silent SSO exists as a JSON probe: GET /auth/authorize returns a code and state for live sessions or a login_required status otherwise.

When should I use a generic OIDC library instead of the hand-rolled BFF flow?▼

Use a generic library when your framework already ships one, when you federate multiple identity providers, or when you only need back-channel endpoints. For new integrations, the hand-rolled BFF flow is the recommended default.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

web-vuln-oauth

Detect OAuth 2.0 and OpenID Connect misconfigurations enabling redirect_uri bypasses and token leakage.

Community
Advanced
SyedaashnaghazanfarSyedaashnaghazanfar
3

better-auth-python

Verify Better Auth JWTs in Python/FastAPI backends using JWKS signature validation.

Community
Intermediate
christianearle01christianearle01

api-debugging

Diagnose API requests and responses to resolve HTTP errors and network failures.

Community
Basic
curtismu7curtismu7
1

pingone-davinci-orchestration

Implements and debugs PingOne DaVinci widget and Orchestration SDK authentication flows.

Community
Advanced