List of DNs to try and bind the user ID to before validating the password.

For example, the user ID can be bound to the local AD/LDAP branch, and then to the offshore branch if not found in the local one:

cn={UID},OU=Users,OU=corp,DC=co
cn={UID},OU=Offshore Users,OU=corp,DC=co

Display name shown on the login button, e.g. Google, Azure AD, Keycloak. Defaults to "OpenID Connect" when left blank.

Base URL of the identity provider. MockMotor will fetch {issuerUrl}/.well-known/openid-configuration to discover endpoints automatically.

Examples: https://accounts.google.com, https://login.microsoftonline.com/{tenant}/v2.0, https://your-keycloak/realms/myrealm

Required for confidential clients. Leave blank to keep the currently saved secret. Use PKCE-only (public client) by leaving this empty and configuring the IdP accordingly.

Space-separated list of OAuth scopes to request. openid profile email is the standard set for OpenID Connect. Add provider-specific scopes (e.g. groups) to receive group claims.

One group name per line. Users whose groups or roles claim contains any of these values will be granted MockMotor admin rights on login.