Single sign-on with OIDC

Osuite supports single sign-on (SSO) through any OpenID Connect (OIDC) provider. Because the integration is generic OIDC, it works the same way whether your identity provider is Okta, Microsoft Entra ID, Google Workspace, Auth0, Keycloak, or another OIDC-compliant service.

If you do not want to run SSO, the alternative is email invites with password login — see User management.

What Osuite needs

To connect a provider, Osuite needs the standard OIDC client details, which you obtain by registering Osuite as an application in your identity provider:

• Issuer URL — the provider’s OIDC issuer (discovery) URL, from which Osuite reads the provider’s endpoints and signing keys.
• Client ID — the identifier your provider issues for the Osuite application.
• Client secret — the secret paired with that client ID.

Your provider may also let you choose the scopes it releases. The standard OIDC scopes openid, email, and profile are sufficient for Osuite to identify a user.

Register Osuite with your provider

When you create the application in your identity provider, it will ask for a redirect (callback) URL — the address the provider returns the user to after they authenticate. Osuite displays the exact callback URL to register on its SSO settings screen. It is region-specific, so copy the value Osuite shows rather than composing it by hand.

Configure SSO in Osuite

1. Open the Osuite UI and go to the single sign-on settings under Settings.
2. Enter the Issuer URL, Client ID, and Client secret from your provider.
3. Save the configuration and sign in once to confirm the round trip works.

Permissions are not sourced from OIDC

Caution

OIDC governs authentication only — it decides whether a person can sign in, not what they can do once inside. Osuite does not read roles or permissions from OIDC claims. Every user’s permissions are set in the Osuite UI under Settings → Users, regardless of how they sign in.

After a user first signs in through SSO, assign their permissions in User management. Changing a group or claim in your identity provider does not change what that user can do in Osuite.

Next steps

• User management — assign roles and permissions after a user signs in
• Security and privacy — how Osuite handles authentication and data