Single sign-on · Setup guides

Use this guide for any OpenID Connect identity provider.

Step 1: Create application

Register a new application (sometimes called a client or an app registration) in your identity provider and set its redirect or callback URL:

Callback URL

https://app.orbitid.com/api/oauth/oidc

The OIDC callback URL shown in your OrbitID Configuration page.

Since OrbitID acts as a proxy between your app and the OIDC identity provider, the application or client registered here is OrbitID.

Step 2: Scopes and claims

Make sure the application can request the openid, email and profile scopes. OrbitID maps the sub, email, given_name and family_name claims to id, email, firstName and lastName.

Step 3: Copy the client details

Client / Application ID

The OIDC identity provider normally generates a unique identifier for the registered app. Make a note of this to be used later when creating the SSO connection in OrbitID.

Client Secret

Along with the Client ID, the IdP also generates a client secret which is used to authenticate the client while issuing tokens. Make a note of this to be used later when creating the SSO connection in OrbitID.

Discovery URL

Most providers publish an OpenID Connect discovery document at https://<issuer>/.well-known/openid-configuration. OrbitID uses it to find the authorization, token, userinfo and JWKS endpoints, so note the URL as well.

Finish in OrbitID

Finish in OrbitID: paste the Client ID, Client Secret and discovery URL into the connection form (or the Admin Portal link). In the dashboard, open the environment, go to Connections, click New connection and choose OIDC. If your customer's admin is following an Admin Portal link, they enter the values in the final step of the portal instead.

You can also create the connection with the API: POST /api/v1/sso as described in the quickstart.