Set Up OIDC SSO

Connect Google, Microsoft Entra ID, Okta or any OpenID Connect identity provider to CloudThinker with an issuer URL and client ID.

OpenID Connect (OIDC) is the sign-in layer on top of OAuth 2.0. You register CloudThinker as an OAuth client in your identity provider (IdP), then give CloudThinker three values: Issuer URL, Client ID and Client Secret.

Prerequisites

• A verified email domain, the organization Owner role, and an eligible plan. See Set up single sign-on.
• Admin access to your identity provider, with permission to create OAuth or OIDC applications.

What you exchange

Direction	Value	Notes
CloudThinker → your IdP	Redirect URI: https://<your-cloudthinker-api-host>/api/v1/sso/oidc/callback	Register it exactly, as a Web redirect URI
Your IdP → CloudThinker	Issuer URL	The issuer base, not the .well-known address. CloudThinker discovers the endpoints from <issuer>/.well-known/openid-configuration.
Your IdP → CloudThinker	Client ID	Required
Your IdP → CloudThinker	Client Secret	Required for confidential clients (the usual web app setup). Leave empty only for public clients using PKCE.

CloudThinker requests the openid, email and profile scopes. It reads the user’s email from the email claim (falling back to preferred_username) and the name from given_name and family_name. It doesn’t read groups.

Client setting	What CloudThinker uses
Grant type	Authorization Code
PKCE	Always sent, with S256, for confidential and public clients
Token endpoint authentication	client_secret_post (the secret goes in the request body). Leave it out for a public client.

The OIDC wizard doesn’t display the redirect URI. To find your host, start Setup SSO, pick SAML 2.0, and click Next. The ACS URL on the SP Metadata step uses the same host: replace /api/v1/sso/saml/acs with /api/v1/sso/oidc/callback. Then click Back and choose OIDC.

Configure your provider

Go to Admin Settings → Identity and access → Setup SSO, choose OpenID Connect (OIDC), and click Next. The IdP Config step asks for Display Name (any label, for example Okta OIDC), Issuer URL, Client ID and Client Secret.

Okta

1. Create an OIDC app

   In the Okta Admin Console, go to Applications → Applications → Create App Integration. Choose OIDC - OpenID Connect and Web Application. Under Grant type, keep Authorization Code.

2. Add the redirect URI

   Under Sign-in redirect URIs, paste CloudThinker’s redirect URI. Assign the people or groups who need access, then save.

3. Finish in CloudThinker

   From the app’s General tab, copy the Client ID and Client secret. On the IdP Config step, enter:

   • Issuer URL: https://your-org.okta.com. If you use a custom authorization server, enter its issuer instead, for example https://your-org.okta.com/oauth2/default.
   • Client ID and Client Secret: from the Okta app

   Click Create Connection.

Microsoft Entra ID

1. Register an application

   In the Azure portal, go to Microsoft Entra ID → App registrations → New registration. Name it CloudThinker. Under Redirect URI, select Web and paste CloudThinker’s redirect URI. Click Register.

2. Create a client secret

   Go to Certificates & secrets → New client secret. Copy the secret Value right away; Entra shows it only once. Note its expiry date.

3. Add the email claim

   Go to Token configuration → Add optional claim → ID, select email, and click Add. On API permissions, confirm Microsoft Graph openid, email and profile are listed.

   Without the email claim, CloudThinker falls back to preferred_username, which is the user’s UPN. That works only when UPNs are on a verified domain.

4. Finish in CloudThinker

   On the IdP Config step, enter:

   • Issuer URL: https://login.microsoftonline.com/<tenant-id>/v2.0, using the Directory (tenant) ID from the app’s overview
   • Client ID: the Application (client) ID from the overview
   • Client Secret: the secret value you copied

   Click Create Connection.

Google

1. Configure the OAuth consent screen

   In the Google Cloud console, go to APIs & Services → OAuth consent screen. Choose Internal as the user type so only your Workspace users can sign in, and add the openid, email and profile scopes.

2. Create an OAuth client

   In the Google Cloud console, go to APIs & Services → Credentials → Create credentials → OAuth client ID. Choose Web application as the application type.

3. Add the redirect URI

   Under Authorized redirect URIs, add CloudThinker’s redirect URI and click Create. Copy the Client ID and Client secret.

4. Finish in CloudThinker

   On the IdP Config step, enter:

   • Issuer URL: https://accounts.google.com
   • Client ID and Client Secret: from the OAuth client

   Click Create Connection.

Other OIDC provider

Any provider works if it publishes a discovery document at <issuer>/.well-known/openid-configuration.

1. Register CloudThinker as a web client

   Create an OAuth 2.0 / OIDC web application in your provider. Add CloudThinker’s redirect URI and allow the openid, email and profile scopes.

2. Fill in IdP Config

   Field	What to enter
   Display Name	Any label, for example Okta OIDC
   Issuer URL	Your provider’s issuer, exactly as it appears in the issuer field of its discovery document
   Client ID	The client ID your provider issued
   Client Secret	The client secret, or empty for a public PKCE client

   Click Create Connection.

Success state: the dialog shows SSO Connection Created and the connection is Active. Next, run the connection test and a test sign-in from Set up single sign-on.

What the connection test checks

On Manage → Overview, Run connection test checks your configuration without a full sign-in:

Check	Passes when
Discovery Reachable	CloudThinker can fetch <issuer>/.well-known/openid-configuration
Issuer Match	The issuer in that document equals your Issuer URL
Required Endpoints Present	The document lists the authorization, token and signing-key endpoints
Jwks Reachable	CloudThinker can fetch your provider’s signing keys

The test doesn’t verify the client secret or redirect URI. Do a real sign-in to confirm those.

What happens on first sign-in

OIDC follows the same rules as SAML:

If	Then
Provisioning is Just-in-time	CloudThinker creates the account on the person’s first SSO sign-in, with the Auto-assigned organization role (default Viewer) and Auto-assigned workspaces you set.
The person has a pending invitation	The invitation’s role and workspaces apply instead. If the organization has no free seat, sign-in fails with “This organization has reached its seat limit.”
The person already has a CloudThinker account with the same email	CloudThinker links that account to your IdP. No duplicate is created.
Provisioning is Manual and the person has no account or invitation	Sign-in is refused with “No account found. Contact your administrator for access.” Invite them first.
You want IdP groups to decide access	OIDC sign-in doesn’t read groups. Use SCIM to map groups to workspaces.

Rotate the client secret

CloudThinker stores one client secret. Most IdPs, including Entra ID and Okta, let two secrets be valid at once, so you can rotate with no downtime:

1. Create a new secret in your IdP

   Add a second client secret to the CloudThinker app. Leave the old one in place.

2. Save it in CloudThinker

   Open Manage → Configuration on the Single sign-on card, paste the new value into Client Secret, and click Save Changes.

3. Test, then remove the old secret

   Sign in through SSO in a private window. Once it works, delete the old secret in your IdP.

If your IdP allows only one secret, sign-ins fail between replacing it there and saving it in CloudThinker. The Owner can still sign in with an email code. See If your IdP is unavailable.

Troubleshooting

'Redirect URI mismatch' from your provider

The redirect URI in your provider must match https://<your-cloudthinker-api-host>/api/v1/sso/oidc/callback exactly, including https:// and the full path. Use the tip above to confirm the host.

Issuer Match fails

Copy the issuer value straight from your provider’s discovery document. Common mistakes: pasting the full .well-known/openid-configuration address, or leaving out /v2.0 for Entra ID.

Discovery Reachable fails

CloudThinker must reach your issuer over the public internet. An issuer on a private network or behind a VPN can’t be discovered.

'Invalid client' or sign-in fails right after the IdP

Check the Client ID and Client Secret. Expired secrets are a common cause on Entra ID. Follow Rotate the client secret.

Sign-in fails because no email is returned

Your provider isn’t returning an email or preferred_username claim. Allow the email scope for the app and make sure the user has an email address in the directory.

'SSO authentication failed. Please try again or contact your administrator.'

CloudThinker rejected the ID token or the token exchange. Check that the Issuer URL matches the discovery document, the client secret is current, and your IdP accepts client_secret_post and PKCE for this client.

Next steps

Test and require SSO

Run a test sign-in, choose provisioning, and turn on Require SSO

SCIM provisioning

Sync users and groups from your IdP automatically