- 3 minutes to read

OpenID Field Mapping Quick Reference

Use this page when configuring OpenID Connect and OAuth 2.0 values in the Nodinite installation wizard.

What This Page Helps You Do

  • Match each wizard field to the correct Entra ID value
  • Reduce configuration mistakes across Discovery URL, Installation Client, Web Client, Web API, and Log API settings
  • Keep all required IDs, scopes, and claims in one checklist

Field Mapping Table

Section Field Where to Get It Example / Format Your Value
OAuth2 settings Discovery URL Your Entra ID Tenant ID https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration
Installation Client Client ID NodiniteInstallationClient application (client) ID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Installation Client Installation Client Scopes webApi application (client) ID api://<webApi-client-id>/.default
Installation Client Installation Client Claims - Key Fixed value http://schemas.microsoft.com/ws/2008/06/identity/claims/role
Installation Client Installation Client Claims - Value App role value from webApi AppRole_WebApi_all
Web Client Require HTTPS Metadata Required: OAuth2 requires HTTPS, so keep it checked (the installer rejects non-HTTPS discovery URLs) Checked
Web Client Client ID webClient application (client) ID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Web Client Callback Path Registered redirect URI path /signin-oidc
Web Client Scopes Default OIDC scopes plus API scope openid, profile, email, offline_access, api://<webApi-client-id>/nodinite_webapi_all
Nodinite Claims Nodinite Claims (Groups) Entra ID group Object ID groups + group object ID
Nodinite Claims Nodinite Claims (App Roles) Entra ID app role values http://schemas.microsoft.com/ws/2008/06/identity/claims/role + Nodinite.Admin,Nodinite.User
Web API Audiences webApi application (client) ID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Log API Audiences Log API audience identifier nodinite-%ENVIRONMENTNAME%-logapi
MCP Server MCP Server Audiences MCP Endpoint audience identifier api://mcp
MCP Server Web Client MCP Server Scope MCP Server scope for the Web Client api://mcp/.default

Claim Strategy Reminder

Choose one user authorization approach:

  • Groups: use the groups claim with Entra ID group object IDs
  • App roles: use the role claim key with role values such as Nodinite.Admin

For larger tenants, app roles are typically easier to manage and keep token payloads compact.

MCP Server Reminder

The installation wizard now includes an MCP Server block in the OpenID configuration step. Capture both of these values when you configure the lower OAuth section:

  • MCP Server Audiences
  • Web Client MCP Server Scope

For the current Portal defaults, use api://mcp and api://mcp/.default. For the full MCP setup and external client guidance, see MCP Endpoint and MCP Endpoint External Access.

Next Steps