Set up OpenID Connect (OIDC) SSO so your users and readers sign in to Document360 through your identity provider (IdP), such as Okta, Auth0, or ADFS, instead of with a separate Document360 password. OpenID Connect is built on OAuth 2.0: your IdP confirms who is signing in and sends Document360 a signed token, and Document360 grants access.
What OpenID Connect gives you
- Your IdP's security rules apply to Document360. Multi-factor authentication (MFA), conditional access policies, and session controls you set in your IdP apply every time someone signs in.
- You control access from one place. When you deactivate someone in your IdP, they can no longer sign in to Document360.
If you use a cloud-based IdP, such as Okta or Auth0, OpenID Connect is usually the better fit. If you use an on-premises IdP, such as ADFS, SAML is more common. If you want people to open Document360 directly from your IdP's dashboard, use SAML: OpenID Connect doesn't support IdP-initiated sign-in. To compare all sign-in methods, read Single Sign-On (SSO).
Choose your identity provider
Every IdP below supports sign-in for users and readers. They differ in SCIM support, which keeps users and readers in sync with your IdP automatically. Select your IdP to open its step-by-step guide.
| Identity provider | SCIM provisioning |
|---|---|
| Okta | Supported |
| ADFS | Through third-party tools |
| Auth0 | Not supported |
| Other OpenID Connect providers, such as PingOne | If your IdP supports SCIM |
Set up OpenID Connect SSO
Before you begin
- You need the Owner or Admin role in your Document360 project.
- You need admin access to your IdP.
- Your IdP application must accept the client secret in the body of the token request (
client_secret_post). Document360 doesn't supportclient_secret_basic.
Two choices in this setup can't be undone:
- Identity provider: You can't change the IdP after you create the configuration.
- Convert existing accounts to SSO: Converted users and readers lose password sign-in right away and must sign in through your IdP. Each of them receives an email about the change.
- Go to Settings () > Users & Permissions > Enterprise SSO.
- Select Create SSO, and then select OpenID Connect.
- Select your identity provider. If you use Auth0, select Other, because Auth0 doesn't have its own option. The setup wizard opens.
- On Configure SP, copy the sign-in and sign-out redirect URIs that Document360 generates into your IdP's redirect URI fields.
- On Configure IdP, enter the Client ID, Client secret, and Authority from your IdP. The Authority is your IdP's issuer URL: the
issuervalue in its discovery document (/.well-known/openid-configuration). - (Optional) On SCIM, turn on automatic provisioning of users and groups.
- On More settings, set the SSO name, sign-in button text, and idle session timeout. If you want existing users and readers to sign in through your IdP instead of with a password, choose to convert their accounts to SSO.
For where to find these values in your IdP, follow its guide in Choose your identity provider.
When you finish, the configuration appears in the Enterprise SSO list. If sign-in fails, see OpenID SSO issues.
After you set up OpenID Connect
Set up SCIM provisioning
Add, update, and deactivate users and readers in your IdP, and Document360 updates automatically.
Learn more →Remove an OpenID Connect configuration
Find out what happens when you remove an OpenID Connect configuration, and how to do it safely.
Learn more →FAQ
Can I use OpenID Connect and SAML at the same time?
No. SAML and OpenID Connect can't both be active in the same project. To switch, turn off the configuration you no longer want to use.
Can I have more than one OpenID Connect configuration in a project?
Yes. You can have several OpenID Connect configurations active at the same time, each with a different identity provider. For example, you can use Okta for your users and Auth0 for your readers.
Can I use OpenID Connect and JWT at the same time?
Yes. OpenID Connect signs in users and readers through your identity provider, and JWT signs readers in from your own application. Both can be active in the same project.