OpenID Connect (OIDC) User Authentication Client Flow - n8n Workflow

• Developers needing a custom authentication layer for internal tools.
• Automation specialists building secure, access-controlled n8n templates.
• Users who need to integrate n8n directly with enterprise identity providers like Keycloak or Auth0.
• Security engineers looking for examples of robust token handling in a low-code environment.

Implementing secure user authentication often requires complex state management and interaction with authorization servers. This advanced n8n workflow template provides a robust solution for integrating OpenID Connect (OIDC) into any application served by n8n. It efficiently handles the authorization code flow, supports PKCE (Proof Key for Code Exchange) for enhanced security, manages token exchange, and processes user information retrieval. By utilizing a series of specialized n8n node configurations, this template ensures that users accessing the main webhook are either redirected through the authentication loop or granted access to the protected resource immediately if a valid session token is found. This saves significant development time compared to building a custom client from scratch.

The entire process is initiated by a user accessing the primary n8n trigger (the Webhook URL).

1. Trigger and Initialization: The Webhook n8n node receives the inbound request. The Set variables n8n node defines critical OIDC parameters (authorization endpoint, token endpoint, client ID, scopes, etc.).


2. Cookie Check: The Code n8n node executes custom JavaScript to parse the incoming request headers and extract any existing session cookies, specifically looking for a stored accesstoken.


3. Code Exchange (Non-PKCE): The IF we have code in URI and not in PKCE mode n8n node checks if an authorization code is present in the URL query parameters (indicating a fresh redirect from the Identity Provider, or IdP) and if PKCE is disabled. If true, the get accesstoken from /token endpoint with code HTTP Request n8n node performs the token exchange.


4. Token Validation: The IF token is present n8n node checks if an accesstoken exists (either from a successful cookie extraction or the token exchange).


5. User Data Retrieval: If the token is present, the user info HTTP Request n8n node uses the token as a Bearer authorization header to fetch the user's profile details from the OIDC userinfoendpoint.


6. Access Decision: The IF user info ok n8n node checks if user details (specifically email) were successfully retrieved.


7. Successful Authentication: If authenticated, the Welcome page HTML n8n node generates a personalized welcome message, and the send back welcome page n8n node responds to the initial request.


8. Initiating Login: If the token is not present or user info retrieval fails, the login form HTML n8n node is displayed. This HTML contains embedded JavaScript that automatically triggers the OIDC authorization flow (including PKCE logic) by redirecting the user to the IdP's authentication endpoint. This redirects the browser back to the initial n8n webhook URL with the authorization code, restarting the n8n workflow logic to process the new code.

To use this powerful n8n workflow, follow these steps:

1. Import: Copy the provided JSON data and import it directly into your n8n instance.


2. Activate Webhook: Ensure the main Webhook n8n trigger is active. Note its full URL—this is your OIDC redirect URI.


3. Configure OIDC Variables: Open the Set variables : auth, token, userinfo, client id, scope n8n node and input the required values from your Identity Provider (e.g., Keycloak):

1. IdP Setup (Keycloak example provided in notes): Ensure your client configuration in your IdP is set up for the Standard flow (Authorization Code) and that the n8n webhook URL is listed as a valid redirect URI. If you enable PKCE in the n8n node, the client authentication (secret) might be disabled on the IdP side.


2. Activation: Once configured, activate the entire n8n workflow. Accessing the webhook URL will now initiate the OIDC authentication process.

Webhook (n8n trigger): The entry point of the entire authentication flow, receiving initial requests and handling redirects from the OIDC IdP.
Set variables : auth, token, userinfo, client id, scope (Set n8n node): Crucial for defining all necessary OIDC endpoints, IDs, and configuration flags (like PKCE). All subsequent HTTP Requests use data dynamically retrieved from this n8n node.
Code (n8n node): Executes custom JavaScript to parse HTTP headers and extract cookies, specifically checking for a pre-existing accesstoken to bypass the login process.
IF nodes (IF token is present, IF user info ok): These corelogicflowcontrol n8n node components manage the conditional routing, determining if the user needs to be redirected to the IdP or if they have sufficient credentials to proceed.
get accesstoken from /token endpoint with code (HTTP Request n8n node): Used in the non-PKCE flow to exchange the authorization code for an accesstoken by posting credentials to the token endpoint.
user info (HTTP Request n8n node): Fetches the authenticated user's profile details using the Bearer access_token, ensuring the token is valid and associated with a user.

• login form & Welcome page (HTML n8n node): Contain the complex presentation logic. The login form contains the embedded PKCE JavaScript logic required to initiate the secure OIDC authorization process and handle the subsequent token exchange. The success path uses the Welcome page HTML n8n node.