Skip to main content

OpenID Connect

Configure a generic OpenID Connect (OIDC) provider as the Single Sign-On provider for your organization on the Akuity Platform.

Configuring OpenID Connect SSO​

info

Akuity Platform SSO is available on Enterprise plans only. Please contact our Sales Team to access the feature.

The owner role on the Organization is required to configure SSO.

  1. Go to Organization > SSO.

    SSO Settings

  2. Click Add Configuration.

  1. Create an OIDC Application.

    • Set Allowed Callback URL to https://auth.akuity.io/login/callback

  2. Populate the configuration details on the form.

    • Client ID: OIDC Application Client ID
    • Email Domain: Your organization's domain name
    • Domain Aliases: Additional domains to match organization members (e.g. some-org.com).
    • Channel:
      • Front Channel uses response_mode=form_post and response_type=id_token
      • Back Channel uses response_type=code
    • Discovery URL: OIDC Discovery URL to fill Issuer details
    • Issued details:
      • Client Secret: OIDC Application Client Secret (required for the Back Channel)
      • Issuer: URL of the Issuer Identifier.
      • Authorization Endpoint: URL of the OpenID Provider's OAuth 2.0 Authorization Endpoint.
      • Token endpoint: URL of the OpenID Provider's OAuth 2.0 Token Endpoint (required for the Back Channel).
      • Jwks URL: URL of the OpenID Provider's JSON Web Key Set document.
    • Auto Add Member: Allow your organization members to join your organization with the member role automatically.
note

For security purposes, your domain and domain aliases will be submitted to Akuity for manual review and approval.

OIDC SSO Settings

IDP Groups Mapping​

caution

IDP Groups does not work for Okta native integration as Okta does not support groups claim. Please use generic SAML/OIDC option instead to connect with Okta if you want to use this feature.

To configure IDP Groups for an Organization in the Akuity Platform:

  1. Go to Organization > SSO.

  2. Click Add New Rule in the IDP Mapping.

    The IDP Mapping section, listing each IDP group and the organization role it grants

  3. In the Add IDP Group Mapping select the role and specify the corresponding IDP Group for your provider.

  4. Click the Add button.

note

In the SSO settings, if the Auto Add Member is checked the new user will join your organization with the member role automatically.

IDP Team Mapping​

caution

IDP Team Mapping does not work for Okta native integration as Okta does not support groups claim. Please use generic SAML/OIDC option instead to connect with Okta if you want to use this feature.

This feature allows you to map users with a specific OIDC group to a team in your organization.

Your organization must have at least one Team.

The Teams tab of an organization, with the Edit Team dialog open

To configure this feature for an Organization in the Akuity Platform:

  1. Go to Organization > SSO.

  2. Scroll down to the "IDP Team Mapping" section and click Add New Mapping.

    The IDP Team Mapping section, listing each IDP group and the team it maps to

  3. In the modal that appears, specify an IDP group and select an existing team from the dropdown.

  4. Click the Add button.

Now, when a user logs in with the specified IDP group, they will be added to the selected team in your organization.