OIDC SSO Setup

Connect Google, Microsoft Entra ID, Okta, or any OpenID Connect identity provider to CloudThinker

Set up OpenID Connect single sign-on between your identity provider and CloudThinker. Start the wizard at Admin Settings → Identity and access → Setup SSO, choose OpenID Connect (OIDC), then fill the IdP Config step with an Issuer URL, Client ID, and Client Secret from your provider.

Prerequisites

• A verified email domain and an eligible plan — see Single Sign-On
• Admin access to your identity provider

When registering CloudThinker as an OAuth client, your provider asks for a redirect URI. CloudThinker’s OIDC callback path is /api/v1/sso/oidc/callback on your CloudThinker domain.

Provider setup

Google

1. Create an OAuth client

   Go to console.cloud.google.com → APIs & Services → Credentials → Create Credentials → OAuth client ID, with application type Web application.

2. Add the redirect URI

   Add CloudThinker’s OIDC callback URL under Authorized redirect URIs and click Create, then copy the Client ID and Client Secret.

3. Finish in CloudThinker

   On the IdP Config step, enter:

   • Issuer URL: https://accounts.google.com
   • Client ID and Client Secret: from the OAuth client

   Click Create Connection.

Microsoft Entra ID

1. Register an application

   In the Azure Portal, go to Microsoft Entra ID → App registrations → New registration. Name it CloudThinker, and under Redirect URI select Web and paste CloudThinker’s OIDC callback URL.

2. Create a client secret

   Go to Certificates & secrets → New client secret and copy the secret Value immediately — it is shown only once.

3. Finish in CloudThinker

   On the IdP Config step, enter:

   • Issuer URL: https://login.microsoftonline.com/{tenant-id}/v2.0
   • Client ID: the Application (client) ID from the registration overview
   • Client Secret: the secret value you copied

   Click Create Connection.

Okta

1. Create an OIDC app

   In the Okta Admin Console, go to Applications → Create App Integration → OIDC - OpenID Connect → Web Application.

2. Configure the redirect URI

   Under Sign-in redirect URIs, paste CloudThinker’s OIDC callback URL and save.

3. Finish in CloudThinker

   On the IdP Config step, enter:

   • Issuer URL: https://your-org.okta.com
   • Client ID and Client Secret: from the Okta app’s General tab

   Click Create Connection.

Generic OIDC

Works with any OpenID Connect-compliant provider that publishes a discovery document.

1. Register CloudThinker as an OAuth client

   Create a new OAuth 2.0 / OIDC web application in your provider and add CloudThinker’s OIDC callback URL as a redirect URI.

2. Finish in CloudThinker

   Field	Description
   Display Name	Any label, for example “Okta OIDC”
   Issuer URL	Your provider’s issuer — CloudThinker reads <issuer>/.well-known/openid-configuration for its endpoints
   Client ID	The client ID your provider issued
   Client Secret	The client secret your provider issued

   Click Create Connection.

Troubleshooting

'Redirect URI mismatch' from the identity provider

The redirect URI registered in your provider must exactly match CloudThinker’s OIDC callback URL, including https:// and the full path.

'Invalid client' or authentication fails immediately

Re-check the Client ID and Client Secret — Entra ID shows the secret value only once at creation, and expired secrets must be replaced in both places.

Issuer or discovery errors

The Issuer URL must be the provider’s issuer base (for example https://accounts.google.com), not the full .well-known/openid-configuration address.

Next steps

Test and Enforce SSO

Test the connection, turn on Require SSO, and choose a provisioning mode

SCIM Provisioning

Sync users and groups automatically from your identity provider