Connect an OpenID Connect provider

You connect a generic OpenID Connect provider as an Identity Provider under Integrations → Identity Providers. You name the connection, enter the provider's issuer URL and client credentials, then save and assign it to the companies whose users should sign in through it. The OIDC option works with any standards-compliant OpenID Connect provider.

Where do you connect an OpenID Connect provider?

Open Integrations → Identity Providers, start a new connection, and select OpenID Connect (OIDC). The select screen is headed Authentication Providers.

1. Open Integrations → Identity Providers.
2. Start a new connection. The select screen, headed Authentication Providers, lists the provider types.
3. Select OpenID Connect (OIDC), then continue to connect.
4. The connection opens on the Authorization tab, where you enter the credentials.

What does each OpenID Connect field mean?

The Authorization tab asks for a connection name, the provider's issuer, and client credentials. Required fields are marked; two fields are optional. Enter them, then save.

When do you set the optional fields?

Set OIDC Configuration URL (Optional) only when your provider's discovery document is not at the standard path derived from the issuer URL. Set Redirect URIs (Optional) only when you need to record redirect URIs on this connection.

Both fields are left blank for most providers. The required Issuer URL, Client ID, and Client Secret are enough for a standard OpenID Connect setup.

How do you set the display name, icon, and display mode?

Open the Details tab. Set a Display Name for the sign-in button, upload a Display Icon, and pick a Display Mode of Standalone or Grouped. These control how the provider appears on your portal login screen.

A Standalone provider gets its own button on the login screen, showing its display name and icon. A Grouped provider is reached through one shared SSO button instead. See Identity Providers for how each mode looks to the consumer.

How do you assign companies and force SSO?

Open the Assignment tab, which unlocks after you save the provider. Turn on assign all companies or pick specific ones, set Force SSO if those users must use the provider, then save the assignment.

1. Save the connection from the Authorization tab. The Assignment tab is disabled until the provider exists.
2. On Assignment, either toggle assign all companies on, or leave it off and select companies from the searchable list.
3. Toggle Force SSO on to remove password sign-in for those users, or leave it off to keep password as a fallback.
4. Save the assignment with the button on the tab.

How do you activate the provider?

Use the Active toggle above the tabs. With it on and the provider assigned to at least one company, that company's users see this provider's sign-in option on the portal login screen.

When a covered user signs in, the portal redirects them to your OpenID Connect provider to authenticate, then back to your portal. If Force SSO is on for their company, the portal does not offer them a password option.

Troubleshooting

Match what you see to the fix. Connection-level errors surface in your dashboard; sign-in behavior shows on the portal login screen.

Where to next