SSO OneLogin

This page shows how to set up Single Sign-On (SSO) between OneLogin and your digital signage account using OpenID Connect (OIDC), so your users sign in with their OneLogin account. You do it in OneLogin and in Settings > Single Sign-On. For how SSO works, see Single Sign-On (SSO).

Before you start

• Admin access to OneLogin.
• The account owner’s sign-in: only the account owner can set up SSO.
• Access to your domain’s DNS settings, to add one TXT record that proves you own your email domain.
• The redirect URI for OneLogin: the SSO page doesn’t show a redirect URI for OIDC, so ask our support team for it.

1. Create a custom connector in OneLogin

1. In OneLogin, go to Applications > Custom Connectors.

2. Create a new connector and give it a name. You can upload icons for your app catalog.
3. Under Sign on method, choose OpenID Connect.
4. Enter the Redirect URI you received from our support team.
5. Choose RS256 as the Signing Algorithm.
6. Click Save.

2. Add the app to your catalog

1. In Custom Connectors, click Add App to Connector next to your connector.

2. Fill in the details and click Save.

3. Under Access or Users, give the users who should sign in access to the app.

3. Copy the OneLogin details

On the app’s SSO tab, copy the Client ID, the Client Secret (click Show client secret) and the Issuer URL.

4. Enter the details on the SSO page

1. Go to Settings > Single Sign-On.
2. Set Protocol to OpenID Connect (OIDC).
3. Enter a Display name and your Email domains.
4. Paste the Issuer URL, the Client ID and the Client Secret. You can paste the full .well-known/openid-configuration link as the Issuer URL; it is trimmed for you.
5. Click Save configuration.

5. Verify your domain and sign in

1. The Domain verification panel shows a TXT record. Add it in your DNS provider, then click Verify domain.
2. When the domain is verified, your users can sign in with Log in with SSO on the login page, with the SSO login link, or by typing their work email.
3. Once SSO works, you can switch on Enforce SSO for these domains.

See Single Sign-On (SSO) for each of these steps, enforcing SSO and troubleshooting.

To decide what each user can do, see Teams.