Skip to main content
Permitech provides Single sign-on capabilities for various providers using the OIDC protocol when using your own cluster. If your provider is not listed above, additional SSO providers can be added on-demand. Contact Permitech to enable this.
Single sign-on is only supported when you are using your own Permitech cluster. This is not available in the free version of Permitech, or a paid version running on permi.tech.

​
Google

  1. Follow this guide to set up your OAuth credentials
    • User Type is Internal
    • Scopes are .../auth/userinfo.profile and openid
    • Authorized domains is your domain for Permitech console
  2. When creating a new client ID, set:
    • type to Web application
    • Authorized redirect URIs to https://{CONSOLE_URL}/api/auth/callback/google, replacing {CONSOLE_URL} with the URL of your Permitech console
  3. Share your Client ID and Client Secret with Permitech

​
Microsoft Entra ID

  1. Follow this guide to create a new application
  2. Under Redirect URI, set:
    • The type to Web
    • The URI to https://{CONSOLE_URL}/api/auth/callback/azure-ad, replacing {CONSOLE_URL} with the URL of your Permitech console
  3. Go to Token configuration page, Add Optional Claim, choose the ID token and email claim. Ensure each user has their email set in the Contact Information properties. Permitech will use this email as the account.
  4. Go to the Certificates & secrets page, select New Client Secret, and create a new secret
  5. Share the Tenant ID, Client ID, and Client Secret with Permitech

​
Okta

  1. Follow this guide to create a new application
  2. Select:
    • OIDC - OpenID Connect as the Sign-in method
    • Web Application as the application type
    • Authorization Code as the Grant Type
  3. Set Sign-in redirect URIs to https://{CONSOLE_URL}/api/auth/callback/okta, and Sign-out redirect URIs to https://{CONSOLE_URL}, replacing {CONSOLE_URL} with the URL of your Permitech console
  4. Share the Issuer URL, Client ID, and Client Secret with Permitech. You can find the Issuer URL in Security -> API in the admin panel. The audience should be api://default.

​
PingFederate

  1. Follow this guide to create an application
  2. Set the Application Type to OIDC Web App
  3. Go to the app configuration page, and set the Redirect URIs to https://{CONSOLE_URL}/api/auth/callback/custom, replacing {CONSOLE_URL} with the URL of your Permitech console
  4. Share the Environment ID, Client ID, and Client Secret with Permitech

​
Custom OIDC Provider

  1. Create an application/client with OIDC as the protocol, Web Application as the application type, and Authorization Code as the Grant Type
    1. Ensure an email claim is returned as part of the ID Token
  2. Set Sign-in redirect URIs to https://{CONSOLE_URL}/api/auth/callback/custom, Sign-out redirect URIs to https://{CONSOLE_URL}, and Web origins to https://{CONSOLE_URL}, replacing {CONSOLE_URL} with the URL of your Permitech console
  3. Create a Client Secret
  4. Share all these with Permitech:
    1. CLIENT_ID
    2. CLIENT_SECRET
    3. TOKEN_URL (e.g. https://{BASE_URL}/token)
    4. USERINFO_URL (e.g. https://{BASE_URL}/userinfo)
    5. ISSUER
    6. JWKS_URL (e.g. https://{BASE_URL}/certs)
    7. AUTHORIZATION_URL (e.g. https://{BASE_URL}/auth?response_type=code)