diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden
index 61b2ab3263d..0beb484a3da 100644
--- a/cli/testdata/coder_server_--help.golden
+++ b/cli/testdata/coder_server_--help.golden
@@ -807,6 +807,12 @@ OIDC OPTIONS:
--oidc-name-field string, $CODER_OIDC_NAME_FIELD (default: name)
OIDC claim field to use as the name.
+ --oidc-redirect-url url, $CODER_OIDC_REDIRECT_URL
+ Optional override of the default redirect url which uses the
+ deployment's access url. Useful in situations where a deployment has
+ more than 1 domain. Using this setting can also break OIDC, so use
+ with caution.
+
--oidc-group-regex-filter regexp, $CODER_OIDC_GROUP_REGEX_FILTER (default: .*)
If provided any group name not matching the regex is ignored. This
allows for filtering out groups that are not needed. This filter is
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index 14eca1624ec..bba55f81bec 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -3087,9 +3087,6 @@ communicating directly.`,
Value: &c.OIDC.RedirectURL,
Group: &deploymentGroupOIDC,
UseInstead: nil,
- // In most deployments, this setting can only complicate and break OIDC.
- // So hide it, and only surface it to the small number of users that need it.
- Hidden: true,
},
{
Name: "OIDC Auto Repair Links",
diff --git a/docs/admin/setup/configuration-reference.md b/docs/admin/setup/configuration-reference.md
index 48d1779a726..2c36f7c422a 100644
--- a/docs/admin/setup/configuration-reference.md
+++ b/docs/admin/setup/configuration-reference.md
@@ -1593,6 +1593,14 @@ OIDC claim field to use as the name.
- YAML key: `oidc.nameField`
- Default value: `name`
+### Redirect URL
+
+Optional override of the default redirect url which uses the deployment's access url. Useful in situations where a deployment has more than 1 domain. Using this setting can also break OIDC, so use with caution.
+
+- Environment variable: `CODER_OIDC_REDIRECT_URL`
+- CLI flag: [`--oidc-redirect-url`](../../reference/cli/server.md#--oidc-redirect-url)
+- YAML key: `oidc.oidc-redirect-url`
+
### Regex group filter
If provided any group name not matching the regex is ignored. This allows for filtering out groups that are not needed. This filter is applied after the group mapping.
diff --git a/docs/reference/cli/server.md b/docs/reference/cli/server.md
index 7840f2bd8b7..70a4e48b2e0 100644
--- a/docs/reference/cli/server.md
+++ b/docs/reference/cli/server.md
@@ -722,6 +722,16 @@ The custom text to show on the error page informing about disabled OIDC signups.
OIDC issuer urls must match in the request, the id_token 'iss' claim, and in the well-known configuration. This flag disables that requirement, and can lead to an insecure OIDC configuration. It is not recommended to use this flag.
+### --oidc-redirect-url
+
+| | |
+|-------------|---------------------------------------|
+| Type | url |
+| Environment | $CODER_OIDC_REDIRECT_URL |
+| YAML | oidc.oidc-redirect-url |
+
+Optional override of the default redirect url which uses the deployment's access url. Useful in situations where a deployment has more than 1 domain. Using this setting can also break OIDC, so use with caution.
+
### --telemetry
| | |
diff --git a/enterprise/cli/testdata/coder_server_--help.golden b/enterprise/cli/testdata/coder_server_--help.golden
index 263d399ea15..fe38309bee3 100644
--- a/enterprise/cli/testdata/coder_server_--help.golden
+++ b/enterprise/cli/testdata/coder_server_--help.golden
@@ -808,6 +808,12 @@ OIDC OPTIONS:
--oidc-name-field string, $CODER_OIDC_NAME_FIELD (default: name)
OIDC claim field to use as the name.
+ --oidc-redirect-url url, $CODER_OIDC_REDIRECT_URL
+ Optional override of the default redirect url which uses the
+ deployment's access url. Useful in situations where a deployment has
+ more than 1 domain. Using this setting can also break OIDC, so use
+ with caution.
+
--oidc-group-regex-filter regexp, $CODER_OIDC_GROUP_REGEX_FILTER (default: .*)
If provided any group name not matching the regex is ignored. This
allows for filtering out groups that are not needed. This filter is