diff --git a/Makefile b/Makefile
index c6922189c..c0ba9a087 100644
--- a/Makefile
+++ b/Makefile
@@ -39,9 +39,10 @@ COVER_PKGS_pkg         = ./pkg/...
 COVER_PKGS_all         = $(COVER_PKGS_pkg),$(COVER_PKGS_system),$(COVER_PKGS_compose),$(COVER_PKGS_federation),$(COVER_PKGS_automation)
 COVER_PKGS_integration = $(COVER_PKGS_all)
 
+TEST_SUITE_app         = ./app/...
 TEST_SUITE_pkg         = ./pkg/...
 TEST_SUITE_services    = ./compose/... ./system/... ./federation/... ./auth/... ./automation/...
-TEST_SUITE_unit        = $(TEST_SUITE_pkg) $(TEST_SUITE_services)
+TEST_SUITE_unit        = $(TEST_SUITE_pkg) $(TEST_SUITE_app) $(TEST_SUITE_services)
 TEST_SUITE_integration = ./tests/...
 TEST_SUITE_store       = ./store/tests/...
 TEST_SUITE_all         = $(TEST_SUITE_unit) $(TEST_SUITE_integration) $(TEST_SUITE_store)
diff --git a/app/boot_levels.go b/app/boot_levels.go
index bcfd6c97c..4e1780054 100644
--- a/app/boot_levels.go
+++ b/app/boot_levels.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	authService "github.com/cortezaproject/corteza-server/auth"
+	"github.com/cortezaproject/corteza-server/auth/external"
 	authHandlers "github.com/cortezaproject/corteza-server/auth/handlers"
 	"github.com/cortezaproject/corteza-server/auth/saml"
 	authSettings "github.com/cortezaproject/corteza-server/auth/settings"
@@ -523,10 +524,20 @@ func updateAuthSettings(svc authServicer, current *types.AppSettings) {
 	)
 
 	for _, p := range cas.External.Providers {
-		if !p.Enabled || p.Handle == "" || p.IssuerUrl == "" || p.Key == "" || p.Secret == "" {
+		if !p.Enabled || p.Handle == "" || p.Key == "" || p.Secret == "" {
 			continue
 		}
 
+		if strings.HasPrefix(p.Handle, external.OIDC_PROVIDER_PREFIX) {
+			if p.IssuerUrl == "" {
+				// OIDC IdPs need to have issuer URL
+				continue
+			}
+		} else {
+			// non-OIDC provider do not need issuer URL
+			p.IssuerUrl = ""
+		}
+
 		providers = append(providers, authSettings.Provider{
 			Handle:      p.Handle,
 			Label:       p.Label,
diff --git a/app/boot_levels_test.go b/app/boot_levels_test.go
new file mode 100644
index 000000000..f0fc4f533
--- /dev/null
+++ b/app/boot_levels_test.go
@@ -0,0 +1,129 @@
+package app
+
+import (
+	"context"
+	"testing"
+
+	"github.com/cortezaproject/corteza-server/auth/external"
+	authSettings "github.com/cortezaproject/corteza-server/auth/settings"
+	"github.com/cortezaproject/corteza-server/system/types"
+	"github.com/go-chi/chi"
+	"github.com/stretchr/testify/require"
+)
+
+type (
+	authSettingsUpdaterMockedAuthService struct {
+		settings *authSettings.Settings
+	}
+)
+
+func (*authSettingsUpdaterMockedAuthService) MountHttpRoutes(string, chi.Router) {}
+func (*authSettingsUpdaterMockedAuthService) Watch(context.Context)              {}
+func (m *authSettingsUpdaterMockedAuthService) UpdateSettings(settings *authSettings.Settings) {
+	m.settings = settings
+}
+
+func Test_updateAuthSettings(t *testing.T) {
+	cc := []struct {
+		name string
+		in   types.AppSettings
+		out  authSettings.Settings
+	}{
+		{
+			"enabled internal auth",
+			func() (s types.AppSettings) {
+				s.Auth.Internal.Enabled = true
+				return
+			}(),
+			func() (s authSettings.Settings) {
+				s.LocalEnabled = true
+				return
+			}(),
+		},
+		{
+			"add external providers",
+			func() (s types.AppSettings) {
+				s.Auth.External.Providers = []*types.ExternalAuthProvider{
+					{ // skip
+						Enabled: false,
+						Handle:  "disabled",
+						Key:     "key",
+						Secret:  "sec",
+					},
+					{ // skip
+						Enabled: true,
+						Handle:  "malformed",
+						Key:     "",
+						Secret:  "",
+					},
+					{ // skip
+						Enabled: true,
+						Handle:  external.OIDC_PROVIDER_PREFIX + "without-issuer",
+						Key:     "key",
+						Secret:  "sec",
+					},
+					{ // add
+						Enabled:   true,
+						Handle:    external.OIDC_PROVIDER_PREFIX + "with-issuer",
+						IssuerUrl: "issuer",
+						Key:       "key",
+						Secret:    "sec",
+					},
+					{ // add (w/o issuer)
+						Enabled:   true,
+						Handle:    "google",
+						IssuerUrl: "issuer",
+						Key:       "key",
+						Secret:    "sec",
+					},
+					{ // add
+						Enabled: true,
+						Handle:  "github",
+						Key:     "key",
+						Secret:  "sec",
+					},
+					{ // skip
+						Enabled: false,
+						Handle:  "linkedin",
+						Key:     "key",
+						Secret:  "sec",
+					},
+				}
+				return
+			}(),
+			func() (s authSettings.Settings) {
+				s.Providers = []authSettings.Provider{
+					{
+						Handle:    external.OIDC_PROVIDER_PREFIX + "with-issuer",
+						IssuerUrl: "issuer",
+						Key:       "key",
+						Secret:    "sec",
+					},
+					{
+						Handle: "google",
+						Key:    "key",
+						Secret: "sec",
+					},
+					{
+						Handle: "github",
+						Key:    "key",
+						Secret: "sec",
+					},
+				}
+				return
+			}(),
+		},
+	}
+
+	for _, c := range cc {
+		t.Run(c.name, func(t *testing.T) {
+			var (
+				req = require.New(t)
+				m   = &authSettingsUpdaterMockedAuthService{}
+			)
+
+			updateAuthSettings(m, &c.in)
+			req.Equal(*m.settings, c.out)
+		})
+	}
+}