Configure OpenID Connect (OIDC) providers for SSO authentication.
One OIDC provider requires sso.oidc. Put it in the providers of SsoPlugin.init(), or in the sso block of VendurePlatform.init(). This provider does not read groups. It always gets defaultRoleIds.
More OIDC providers, and OIDC providers with claimsMapping.roles, require the sso.federation grant and the @vendure-platform/sso-federation package. Put them in the federation providers: the second argument of SsoFederationPlugin.init(), or the ssoFederation block of VendurePlatform.init(). The sso providers take at most one OIDC provider.
Sign in with your Vendure Console account to read this documentation.