# Identity provider setup

> One page per identity provider, written for the customer's IdP admin. The DFE operator sends the admin the page for their IdP plus two values: the DFE console host and the provider name. The admin follows the page once and sends back the client credentials, the issuer and the group identifiers.

| IdP | Page | DFE provider type | A group links on |
|---|---|---|---|
| Google Workspace | [google.md](/v/2.2.2/dfe-engine/control-plane/idp-setup/google.md) | `google` | The Cloud Identity group id, the part after `groups/` |
| Microsoft Entra ID | [entra.md](/v/2.2.2/dfe-engine/control-plane/idp-setup/entra.md) | `entra_id` | The group's object id (a GUID) |
| Okta | [okta.md](/v/2.2.2/dfe-engine/control-plane/idp-setup/okta.md) | `okta` | The group name the `groups` claim carries |

Every page uses the same redirect URI, built from those two values:

```text
https://<your DFE console host>/api/v1/auth/oidc/<provider-name>/callback
```

The operator creates the provider with `POST /api/v1/auth/oidc-providers` and links each DFE group by setting two fields in its group file: `source_provider`, the provider name, and `source_id`, the identifier from the table. A group file with a `source_id` and no `source_provider` loads unlinked, with a warning naming it in the engine log: no sign-in reaches it through that id. The provider model and the linking rules are in [rbac.md, section 4](/v/2.2.2/dfe-engine/control-plane/rbac.md#4-oidc-provider-integration).