--- title: "OpenID" slug: "openid" description: "Streamline your login process with Document360's Single Sign-On (SSO) using OpenID Connect, supporting multiple identity providers for secure access." tags: ["OpenID"] updated: 2026-10-23T04:57:58Z published: 2026-10-23T04:57:58Z canonical: "docs.document360.com/openid" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.document360.com/llms.txt > Use this file to discover all available pages before exploring further. # OpenID Set up OpenID Connect (OIDC) SSO so your users and readers sign in to Document360 through your identity provider (IdP), such as Okta, Auth0, or ADFS, instead of with a separate Document360 password. OpenID Connect is built on OAuth 2.0: your IdP confirms who is signing in and sends Document360 a signed token, and Document360 grants access. **What OpenID Connect gives you** - **Your IdP's security rules apply to Document360.** Multi-factor authentication (MFA), conditional access policies, and session controls you set in your IdP apply every time someone signs in. - **You control access from one place.** When you deactivate someone in your IdP, they can no longer sign in to Document360. If you use a cloud-based IdP, such as Okta or Auth0, OpenID Connect is usually the better fit. If you use an on-premises IdP, such as ADFS, SAML is more common. If you want people to open Document360 directly from your IdP's dashboard, use SAML: OpenID Connect doesn't support IdP-initiated sign-in. To compare all sign-in methods, read [Single Sign-On (SSO)](/help/docs/single-sign-on-sso). --- ## Choose your identity provider Every IdP below supports sign-in for users and readers. They differ in SCIM support, which keeps users and readers in sync with your IdP automatically. Select your IdP to open its step-by-step guide. | Identity provider | SCIM provisioning | | --- | --- | | [Okta](/help/docs/okta-with-openid-sso) | Supported | | [ADFS](/help/docs/adfs-with-openid-sso) | Through third-party tools | | [Auth0](/help/docs/auth0-with-openid-sso) | Not supported | | [Other OpenID Connect providers](/help/docs/other-configurations-with-openid-sso), such as PingOne | If your IdP supports SCIM | --- ## Set up OpenID Connect SSO **Before you begin** - You need the Owner or Admin role in your Document360 project. - You need admin access to your IdP. - Your IdP application must accept the client secret in the body of the token request (`client_secret_post`). Document360 doesn't support `client_secret_basic`. WARNING Two choices in this setup can't be undone: - **Identity provider**: You can't change the IdP after you create the configuration. - **Convert existing accounts to SSO**: Converted users and readers lose password sign-in right away and must sign in through your IdP. Each of them receives an email about the change. 1. Go to **Settings** () > **Users & Permissions** > **Enterprise SSO**. 2. Select **Create SSO**, and then select **OpenID Connect**. 3. Select your identity provider. If you use Auth0, select **Other**, because Auth0 doesn't have its own option. The setup wizard opens. 4. On **Configure SP**, copy the sign-in and sign-out redirect URIs that Document360 generates into your IdP's redirect URI fields. 5. On **Configure IdP**, enter the **Client ID**, **Client secret**, and **Authority** from your IdP. The Authority is your IdP's issuer URL: the `issuer` value in its discovery document (`/.well-known/openid-configuration`). 6. (Optional) On **SCIM**, turn on automatic provisioning of users and groups. 7. On **More settings**, set the SSO name, sign-in button text, and idle session timeout. If you want existing users and readers to sign in through your IdP instead of with a password, choose to convert their accounts to SSO. For where to find these values in your IdP, follow its guide in [Choose your identity provider](/docs/openid#choose-your-identity-provider). When you finish, the configuration appears in the **Enterprise SSO** list. If sign-in fails, see [OpenID SSO issues](/help/docs/openid-sso-issues). --- ## After you set up OpenID Connect Set up SCIM provisioning Add, update, and deactivate users and readers in your IdP, and Document360 updates automatically. [Learn more →](/help/docs/scim-provisioning) Remove an OpenID Connect configuration Find out what happens when you remove an OpenID Connect configuration, and how to do it safely. [Learn more →](/help/docs/removing-a-configured-openid-sso) --- ## FAQ **Can I use OpenID Connect and SAML at the same time?** No. SAML and OpenID Connect can't both be active in the same project. To switch, turn off the configuration you no longer want to use. **Can I have more than one OpenID Connect configuration in a project?** Yes. You can have several OpenID Connect configurations active at the same time, each with a different identity provider. For example, you can use Okta for your users and Auth0 for your readers. **Can I use OpenID Connect and JWT at the same time?** Yes. OpenID Connect signs in users and readers through your identity provider, and JWT signs readers in from your own application. Both can be active in the same project.