Configure OpenID Connect
Connect an OIDC application using Sorena's redirect URI, provider discovery, and client credentials.
Open Workspace > Authentication. You need workspace Admin or Owner access and the Platform and Enterprise SSO licenses. Work with your identity administrator and keep a working sign-in method available while you configure the connection.
Add an OpenID Connect (OIDC) provider or edit an existing one. Complete its shared settings using Workspace sign-in and SSO, then open the OIDC setup worksheet.
Configure the identity-provider application
- Copy Sorena's Redirect URI into the identity-provider application's allowed redirect URI or callback URL field. This is where the application sends the sign-in response. Use the displayed value for the selected Sorena provider.
- Configure the Required claims displayed in Sorena. Claims are identity details returned during sign-in; follow the worksheet's names and guidance.
- If your identity provider needs a start or test sign-in address, use Sorena's optional Login initiation URL. Opening it starts Sorena sign-in and redirects to the identity provider.
- Save the application and obtain its discovery URL, issuer, client ID, and client secret.
Refresh setup values if the Redirect URI is missing. If setup values cannot load, use the offered retry control before continuing.
Enter the application details in Sorena
Under OIDC provider metadata, enter the values from the same identity-provider application.
| Field | What to enter |
|---|---|
| OIDC discovery URL | The provider's discovery document URL, usually ending in .well-known/openid-configuration. |
| Issuer | The issuer identifier in that discovery document. For Microsoft Entra, use the tenant-specific issuer. |
| Client ID | The application's client ID, called Application (client) ID in Entra. |
| Client secret | The application's secret value. When editing, leave blank only when the field hint says this keeps the stored secret. |
Save the provider and correct any validation errors. Check its status and test sign-in with an invited workspace member before restricting other sign-in methods. Domain restrictions and workspace membership still apply, and sign-in does not grant project access.
If you also configure provisioning, follow the selected synchronization mode and its displayed values in the shared administration guide. Keep client secrets and provisioning tokens in their configuration fields. For a persistent failure, contact support with the affected provider and time without sharing those values.
