Add Google and Microsoft SSO to your app — Complete OIDC guide

GET https://<IdP_authorize_endpoint>
  ?client_id=YOUR_CLIENT_ID
  &response_type=code
  &redirect_uri=https://your-app.example.com/auth/callback
  &scope=openid email profile
  &state=RANDOM_ANTI_CSRF
  &nonce=RANDOM_ANTI_REPLAY
  &code_challenge=BASE64URL_SHA256_OF_VERIFIER
  &code_challenge_method=S256

Discovery : https://accounts.google.com/.well-known/openid-configuration
Authorize : https://accounts.google.com/o/oauth2/v2/auth
Token     : https://oauth2.googleapis.com/token
JWKS      : https://www.googleapis.com/oauth2/v3/certs
UserInfo  : https://openidconnect.googleapis.com/v1/userinfo
Issuer    : https://accounts.google.com

Discovery : https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration
Authorize : https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
Token     : https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
JWKS      : https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys
UserInfo  : https://graph.microsoft.com/oidc/userinfo

// OIDC SSO with Google and Microsoft — Node.js (Express + openid-client v5)
// npm i express express-session openid-client
import express from 'express';
import session from 'express-session';
import { Issuer, generators } from 'openid-client';

const app = express();
app.use(session({
  secret: process.env.SESSION_SECRET, resave: false, saveUninitialized: false,
  cookie: { httpOnly: true, secure: true, sameSite: 'lax' },
}));

const REDIRECT = 'https://your-app.example.com/auth/callback';

async function makeClient(issuerUrl, clientId, clientSecret, redirectUri) {
  const issuer = await Issuer.discover(issuerUrl);
  return new issuer.Client({
    client_id: clientId,
    client_secret: clientSecret, // server-side ONLY (confidential client)
    redirect_uris: [redirectUri],
    response_types: ['code'],
  });
}

const clients = {};
(async () => {
  clients.google = await makeClient('https://accounts.google.com',
    process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, REDIRECT + '/google');
  clients.microsoft = await makeClient('https://login.microsoftonline.com/<tenant>/v2.0',
    process.env.MS_CLIENT_ID, process.env.MS_CLIENT_SECRET, REDIRECT + '/microsoft');
})();

app.get('/login/:idp', (req, res) => {
  const client = clients[req.params.idp];
  const code_verifier = generators.codeVerifier();
  const code_challenge = generators.codeChallenge(code_verifier);
  const state = generators.state();
  const nonce = generators.nonce();
  req.session.oidc = { idp: req.params.idp, code_verifier, state, nonce };
  res.redirect(client.authorizationUrl({
    scope: 'openid email profile',
    code_challenge, code_challenge_method: 'S256', state, nonce,
  }));
});

app.get('/auth/callback/:idp', async (req, res) => {
  const client = clients[req.params.idp];
  const { code_verifier, state, nonce } = req.session.oidc || {};
  const params = client.callbackParams(req);
  const tokenSet = await client.callback(
    client.metadata.redirect_uris[0], params,
    { code_verifier, state, nonce }, // openid-client validates everything
  );
  const claims = tokenSet.claims(); // VALIDATED ID token contents

  if (!claims.email || claims.email_verified === false) {
    return res.status(403).send('Email not verified by the provider.');
  }
  const user = await findOrCreateUser({
    provider: req.params.idp, subject: claims.sub, email: claims.email, name: claims.name,
  });
  req.session.userId = user.id;
  delete req.session.oidc;
  res.redirect('/');
});

app.get('/logout', (req, res) => req.session.destroy(() => res.redirect('/')));

# OIDC SSO with Google and Microsoft — Python (Flask + Authlib)
# pip install Flask Authlib
import os
from flask import Flask, session, redirect, url_for, abort
from authlib.integrations.flask_client import OAuth

app = Flask(__name__)
app.secret_key = os.environ["SECRET_KEY"]
app.config.update(SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SECURE=True,
                  SESSION_COOKIE_SAMESITE="Lax")

oauth = OAuth(app)

oauth.register(
    name="google",
    server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
    client_id=os.environ["GOOGLE_CLIENT_ID"],
    client_secret=os.environ["GOOGLE_CLIENT_SECRET"],
    client_kwargs={"scope": "openid email profile"},
)
oauth.register(
    name="microsoft",
    server_metadata_url="https://login.microsoftonline.com/<tenant>/v2.0/.well-known/openid-configuration",
    client_id=os.environ["MS_CLIENT_ID"],
    client_secret=os.environ["MS_CLIENT_SECRET"],
    client_kwargs={"scope": "openid email profile"},
)

@app.route("/login/<idp>")
def login(idp):
    client = oauth.create_client(idp) or abort(404)
    redirect_uri = url_for("callback", idp=idp, _external=True)
    return client.authorize_redirect(redirect_uri)

@app.route("/auth/callback/<idp>")
def callback(idp):
    client = oauth.create_client(idp) or abort(404)
    token = client.authorize_access_token()  # verifies state, exchanges code
    claims = token["userinfo"]  # ID token already validated

    if not claims.get("email") or claims.get("email_verified") is False:
        abort(403, "Email not verified by the provider.")
    user = find_or_create_user(provider=idp, subject=claims["sub"],
                               email=claims["email"], name=claims.get("name"))
    session["user_id"] = user.id
    return redirect("/")

@app.route("/logout")
def logout():
    session.clear()
    return redirect("/")

Issuer    : https://accounts.google.com
Discovery : https://accounts.google.com/.well-known/openid-configuration

Discovery : https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration
({tenant} = common | organizations | consumers | <tenant-id>)