# OpenID Connect Plugin Refactor (OIDC Implicit Flow) **URL:** https://meta.discourse.org/t/openid-connect-plugin-refactor-oidc-implicit-flow/386884 **Category:** Development **Created:** [October 28, 2025, 12:19am UTC](https://meta.discourse.org/t/openid-connect-plugin-refactor-oidc-implicit-flow/386884 "2025-10-28T00:19:52Z") **Posts on this page:** 1 **Showing post:** 1
### Author: ![justinm](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@justinm](https://meta.discourse.org/u/justinm) #### Post date: [October 28, 2025, 12:19am UTC](https://meta.discourse.org/t/openid-connect-plugin-refactor-oidc-implicit-flow/386884/1 "2025-10-28T00:19:52Z")
Hey everyone, I’m looking to improve our security posture, and part of that means that we need to avoid using secret credentials whenever we can. Unfortunately the OIDC plugin required a client secret credential to hit the `/userinfo` endpoint, and I couldn’t set up my forum with it enabled. Fortunately, the OIDC specification is actually defined in a way that doesn’t require the use of any secret tokens. If we stick to the [`id_token` flow](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#send-the-sign-in-request), the IdP will send us all of the information we need to authenticate a user without having to reach back out to the IdP. This is secure because the redirect is configured in the IdP, and we don’t have to worry about the bearer token being forwarded to the wrong destination. I went ahead and created a patch for the OIDC plugin to support the `id_token` flow and submitted a pull request here: [https://github.com/discourse/discourse/pull/35606](https://github.com/discourse/discourse/pull/35606) The PR isn’t _quite_ complete since it still needs unit tests, but it’s pretty much there and I’ve confirmed that this works properly with Azure AD (Entra ID). For ref, here is the documentation for the OIDC plugin: > [@Discourse OpenID Connect (OIDC)](https://meta.discourse.org/t/discourse-openid-connect-oidc/103632): > > discourse2Summary Discourse OpenID Connect allows an OpenID Connect provider to be used as an authentication provider for Discourse.open_bookInstall Guide This plugin is bundled with Discourse core. There is no need to install the plugin separately. Features The plugin aims to provide a minimal implementation of [the specification](https://openid.net/specs/openid-connect-basic-1_0.html). Specifically, it supports the “Authorization Code Flow”. To get started, follow [the plugin installation instructions](https://meta.discourse.org/t/install-plugins-in-discourse/19157), or contact your hosti… --- _[View the full topic](https://meta.discourse.org/t/openid-connect-plugin-refactor-oidc-implicit-flow/386884)._