---
title: "Other configurations with OpenID SSO"
slug: "other-configurations-with-openid-sso"
description: "Set up Single Sign-On (SSO) for Document360 with your OpenID Identity Provider. Follow our guide for seamless integration and configuration tips."
updated: 2026-10-12T08:19:48Z
published: 2026-10-12T08:19:48Z
canonical: "docs.document360.com/other-configurations-with-openid-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.document360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Other configurations with OpenID SSO

If your identity provider (IdP) supports OpenID Connect but isn't listed in Document360, you can still connect it so your users and readers sign in to Document360 with their existing IdP credentials. You create an OpenID Connect application in your IdP, exchange the redirect URLs, client credentials and authority between the two tools, and then choose the optional SCIM provisioning and sign-in settings. This guide covers any OpenID Connect-compatible IdP. If you use Okta, Auth0 or ADFS, follow the provider-specific guide instead.

---

## When to use another OpenID Connect provider

Use the **Others** option when:

- Your organization's IdP supports OpenID Connect but isn't one of the providers listed in Document360.
- You run a custom or self-hosted OpenID Connect identity service.
- You want users and readers to sign in with the credentials they already use for your other applications.

| Capability | Supported |
|---|---|
| User (portal) authentication | Yes |
| Reader (knowledge base site) authentication | Yes |
| SCIM user, reader and group provisioning | Yes, if your IdP supports SCIM |

---

## Before you begin

- You have the **Owner** or **Admin** project role in Document360. Only these roles can configure SSO.
- You have administrator access to your IdP's admin console.
- You have Document360 and your IdP open in two separate browser tabs. You switch between them during setup.

---

## How to configure OpenID SSO with another identity provider

### Step 1: Add a new application in your IdP

1. Log in to your IdP's admin console.
2. Go to the section where you create or manage applications. It is often labeled **Applications**, **Enterprise Applications** or similar.
3. Select the option to create a new application.
4. Configure the basic settings:
   - **Application Name**: Enter a name, for example "Document360 OpenID SSO".
   - **Application Type**: Select **OpenID Connect** as the sign-in method.
5. Save the application settings.

Your IdP creates the application. Keep this tab open; you return to it in Step 3.

---

### Step 2: Get the SP parameters from Document360

1. Switch to the Document360 tab.
2. Go to **Settings** (<span class="fa-solid fa-gear"></span>) > **Users & Permissions** > **Enterprise SSO**.
3. Click **Create SSO** and select **OpenID Connect** (Modern SSO using OpenID Connect (OIDC)).

<!-- SCREENSHOT UPDATE NEEDED: shows the old SSO Configuration page; the menu is now Enterprise SSO and Create SSO offers SAML, OpenID Connect and JWT first. -->
<div align="center">
<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/SSO-configurations.png" class="article_image" alt="Enterprise SSO page in Document360 settings with the Create SSO button.">
</div>

4. On the **Choose IdP** step, select **Others**.

<!-- SCREENSHOT UPDATE NEEDED: IdP selection screen from the IdP-first wizard; recapture after selecting OpenID Connect and highlight the Others option. -->
<div align="center">
<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/oidc-okta.png" class="article_image" alt="Choose IdP step listing the identity providers you can select, including Others.">
</div>

Document360 opens the **Configure SP** step, which shows the parameters you enter in your IdP.

---

### Step 3: Enter the Document360 parameters in your IdP

In your IdP's OpenID Connect application settings, enter the values from the Document360 **Configure SP** step. Field names vary by provider; use the mapping below to find the matching field.

| Document360 | Your IdP |
|---|---|
| Subdomain name | Subdomain name |
| Sign in redirect URL | Redirect URL (sign-in) |
| Sign out redirect URL | Redirect URL (sign-out) |

<div align="center">
<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/oidc-others-sp.png" class="article_image" alt="Configure SP step showing the Subdomain name, Sign in redirect URL and Sign out redirect URL to copy into your IdP.">
</div>

---

### Step 4: Configure scopes and claims in your IdP

1. Make sure your IdP application includes these scopes:

| Scope | Purpose |
|---|---|
| openid | Required for OpenID authentication |
| email | Access to the user's email |
| profile | Access to the user's basic profile information |

2. Map these claims in your IdP:

| Claim | Value |
|---|---|
| sub | The user's unique ID or identifier |
| email | The user's email address (for example, `user.email`) |
| name | The user's name (for example, `user.name`) |

3. Review your settings and save the configuration in your IdP.

Your IdP application now sends the user details Document360 needs to sign people in.

---

### Step 5: Configure the identity provider in Document360

1. Return to Document360 on the **Configure SP** step and click **Next**.

   Document360 opens the **Configure IdP** step.

<div align="center">
<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/oidc-others-idp.png" class="article_image" alt="Configure IdP step in Document360 with the Client ID, Client Secret, Authority and Scope fields.">
</div>

2. Enter the values from your IdP application using the mapping below.

| Document360 | Your IdP |
|---|---|
| Client ID | Client ID |
| Client Secret | Client Secret |
| Authority | Authorization URL or Endpoint |

3. If your IdP requires it, upload the necessary certificates or keys.
4. In the **Scope** (optional) field, type a scope value and click **+** to add it as a chip. Scopes define what user information or permissions Document360 requests from your IdP.
5. Click **Next** to go to the **SCIM** provisioning step.

---

### Step 6: Configure SCIM provisioning (optional)

SCIM provisioning keeps users and readers in Document360 in sync with your IdP. Use it only if your IdP supports SCIM. If you don't need SCIM, skip to [Step 7: Configure SSO name and login options](#step-7-configure-sso-name-and-login-options).

1. Turn on the **Enable SCIM provisioning** toggle.

<div align="center">
<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/oidc-others-scim.png" class="article_image" alt="SCIM provisioning step with the Enable SCIM provisioning toggle and the parameters to enter in your IdP.">
</div>

2. In the confirmation dialog, review the terms, select the checkbox and click **Agree**.

   Document360 displays the SCIM parameters.

3. Use these parameters to turn on SCIM provisioning in your IdP.
4. Turn on the **Enable group sync** toggle if you want users and readers assigned to groups based on your IdP group mappings.
5. In the **Default role** field, keep the default **Contributor** role or select another role from the dropdown. The default role applies to users only.
6. In the **User groups** and **Reader groups** fields, select the groups to add. You can select more than one group. Users in the selected user groups get the default role. Readers in the selected reader groups always get read-only access.
7. Click **Next** to go to the **More settings** page.

---

### Step 7: Configure SSO name and login options

1. In the **SSO name** field, enter a name for the SSO configuration.
2. In **Customize login button**, enter the text for the login button. If you leave the default, the button reads **Login with SSO**.
3. Turn the [**Sign out idle SSO user**](https://docs.document360.com/docs/team-account-idle-timeout){target="_blank"} toggle on or off based on your requirements.
4. To move people who already have Document360 accounts to SSO, turn on **Convert existing team and reader accounts to SSO**. Then, under **Send invite to**, select **All users** or **Selected users**.

   This converts their existing accounts to SSO. It does not create a second account.

<div align="center">
<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/oidc-okta-more-settings.png" class="article_image" alt="More settings page with the SSO name, login button text, Sign out idle SSO user and Convert existing team and reader accounts to SSO options.">
</div>

5. Click **Create**.

The OpenID SSO configuration is now active in Document360 with your identity provider.

:::(Info) (<span class="fa-regular fa-circle-exclamation"></span> NOTE)
The [**Auto assign reader group**](https://docs.document360.com/docs/auto-assign-reader-group){target="_blank"} toggle doesn't appear when you create a configuration. It appears only when you edit an existing SSO configuration. To convert accounts after setup, see [Convert user to SSO](https://docs.document360.com/docs/convert-user-to-sso){target="_blank"} and [Convert reader to SSO](https://docs.document360.com/docs/convert-reader-to-sso){target="_blank"}.
:::

---

### Step 8: Test the sign-in

1. Open the Document360 login page in a private browser window.
2. Enter your email address or project subdomain and click **Login with SSO**, or the button text you set in Step 7.
3. Sign in with your IdP credentials.

You are signed in to Document360 through your IdP. If the sign-in fails, see [OpenID SSO issues](https://docs.document360.com/docs/openid-sso-issues){target="_blank"}.

---

### View and manage SCIM-provisioned readers

If you turned on SCIM, readers your IdP provisions appear in Document360.

1. Go to **Settings** (<span class="fa-solid fa-gear"></span>) > **Users & Permissions** > **Readers & groups**.

<div align="center">
<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/readers.png" class="article_image" alt="Readers list in Document360 where SCIM-provisioned readers show an SSO-SCIM badge next to their name.">
</div>

2. Select a reader to open their profile. Readers provisioned through SCIM show an **SSO-SCIM** badge next to their name.
3. To change what a reader can see, click **Manage Content Access**, choose the access level from the dropdown and click **Update**. New users, readers and groups start with the content access set during SCIM setup; permissions are **None** by default.

<div align="center">
<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/manage.png" class="article_image" alt="Reader account panel with the Manage Content Access option and the reader's groups.">
</div>

4. To change a reader's groups, click **Manage groups** under the **Reader Group** section.

---

## Limits and limitations

| Item | Detail |
|---|---|
| Scopes | You can add up to 3 scopes in the **Scope** field. |
| SCIM | Available only if your IdP supports SCIM. |
| Changes when SCIM is on | You can't edit a person's name, change roles and permissions, or delete a person in Document360. Manage these in your IdP. You can still manage content access in Document360. |
| Deleting people in your IdP | Deleting a profile in your IdP doesn't remove it from Document360. The profile stays with an **Inactive** status. |
| Reader access | Readers always get read-only access. The default role applies to users only. |
| Auto assign reader group | Hidden when you create a configuration; available only on existing configurations. |
| Last active configuration | If this is the only active SSO or JWT configuration and the default login page is disabled, Document360 blocks you from turning it off or deleting it. |

---

## Best practices

- **Copy redirect URLs exactly.** Paste the sign-in and sign-out redirect URLs from the **Configure SP** step without edits, so your IdP returns people to the correct Document360 address.
- **Treat the client secret like a password.** Store it in a password manager or secrets vault, not in shared documents.
- **Test with a small group first.** Confirm that sign-in and claim mapping work before you convert all existing accounts with **Convert existing team and reader accounts to SSO**.
- **Keep the default login page on until SSO works.** Only [deactivate the Document360 login page](https://docs.document360.com/docs/disable-document360-login-page){target="_blank"} after you have tested the SSO sign-in.
- **Turn on SCIM only if your IdP supports it.** Without SCIM support in your IdP, skip Step 6 and manage users and readers in Document360.

---

## Related articles

<div class="doc360-card-row">
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">OpenID</p>
    </div>
    <p class="doc360-card__desc">Learn how OpenID Connect SSO works in Document360 and compare it with SAML.</p>
    <a href="https://docs.document360.com/docs/openid" target="_blank" class="doc360-card__link">Read the overview →</a>
  </div>
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">SCIM provisioning</p>
    </div>
    <p class="doc360-card__desc">See what SCIM provisioning supports for each identity provider.</p>
    <a href="https://docs.document360.com/docs/scim-provisioning" target="_blank" class="doc360-card__link">Learn about SCIM →</a>
  </div>
  <div class="doc360-card">
    <div class="doc360-card__header">
      <p class="doc360-card__title">OpenID SSO issues</p>
    </div>
    <p class="doc360-card__desc">Fix common errors when users sign in with OpenID Connect SSO.</p>
    <a href="https://docs.document360.com/docs/openid-sso-issues" target="_blank" class="doc360-card__link">Troubleshoot sign-in →</a>
  </div>
</div>

- [Remove a configured OpenID SSO](https://docs.document360.com/docs/removing-a-configured-openid-sso){target="_blank"}
- [Other configurations with SAML SSO](https://docs.document360.com/docs/saml-sso-with-other-configurations){target="_blank"}
- [Inviting or Adding SSO users](https://docs.document360.com/docs/inviting-or-adding-sso-users){target="_blank"}

---

## FAQ

<div class="faq-wrapper" data-type="details-wrapper">
<details open>
<summary>
<p>Can I use an identity provider that isn't listed in Document360?</p>
</summary>
<div data-type="details-content">
<p>Yes, if it supports OpenID Connect. Select <strong>OpenID Connect</strong> when you create the SSO configuration, then select <strong>Others</strong> on the <strong>Choose IdP</strong> step.</p>
</div>
</details>
<button class="details-arrow" type="button"></button>
</div>

<div class="faq-wrapper" data-type="details-wrapper">
<details>
<summary>
<p>Does converting existing accounts to SSO create duplicate accounts?</p>
</summary>
<div data-type="details-content">
<p>No. <strong>Convert existing team and reader accounts to SSO</strong> converts each existing account to an SSO account. It does not create a second account.</p>
</div>
</details>
<button class="details-arrow" type="button"></button>
</div>

<div class="faq-wrapper" data-type="details-wrapper">
<details>
<summary>
<p>Why don't I see the Auto assign reader group toggle?</p>
</summary>
<div data-type="details-content">
<p>The toggle is hidden when you create a configuration. It appears only when you edit an existing SSO configuration.</p>
</div>
</details>
<button class="details-arrow" type="button"></button>
</div>

<div class="faq-wrapper" data-type="details-wrapper">
<details>
<summary>
<p>My identity provider doesn't support SCIM. Can I still use it for SSO?</p>
</summary>
<div data-type="details-content">
<p>Yes. Skip the SCIM provisioning step. Users and readers still sign in through your IdP, and you manage their accounts in Document360.</p>
</div>
</details>
<button class="details-arrow" type="button"></button>
</div>