Cloud · Single sign-on · 06

Set up single sign-on with an OpenID Connect provider

Connect Auth0, Keycloak, Amazon Cognito or any OpenID Connect provider to Zym Labs.

This guide connects an OpenID Connect provider, such as Auth0, Keycloak or Amazon Cognito, to your organization. You'll register Zym Labs as a web application in your provider, give Cloud its discovery URL, client ID and secret, test a sign-in and turn the connection on.

You need to be an organization owner or admin in Cloud; an owner turns the connection on.

Before you start

  • A verified domain in your organization. See Verify a domain.
  • Your own account at your identity provider on that domain, to test with.
  • How single sign-on works, if you haven't read it: it explains what turning the connection on changes for your team.

Steps

Start the connection in Cloud

In your organization, open Single sign-on and choose Set up SSO (or New connection). Choose Other OIDC provider, and under Domain this connection signs in, choose your domain.

Register Zym Labs in your provider

Create a web application named Zym Labs: a confidential client that uses the authorization code flow with a client secret. Add the Redirect URI Cloud shows, sometimes called a callback URL. Allow the scopes openid, email and profile.

Give Cloud the connection details

In Cloud, choose I've done this and enter your provider's Discovery URL (it ends in /.well-known/openid-configuration), the Client ID and the Client secret. The URL must be public and use HTTPS. Cloud never shows the secret again; to change it, enter a new one.

Check the attributes

Cloud fills in the attribute names for Email, First name and Last name. Change them only if your directory sends something different, then continue.

Test a sign-in

Choose Start test sign-in and sign in with your own work account in the window Cloud opens. When it works, Cloud shows Passed and what your provider sent for each attribute. To test with someone else's account, see Test a connection.

Turn it on

An owner chooses Activate connection. If you're an admin, choose Save as draft, and an owner can activate it later from Single sign-on. Passwords keep working until you require single sign-on.

What's next

Set up single sign-on with another SAML provider

Connect JumpCloud, OneLogin, PingFederate, ADFS or any SAML 2.0 provider to Zym Labs.

Test a connection

Sign in through a single sign-on connection yourself, or send a test link to someone else.

On this page

Before you startStepsStart the connection in CloudRegister Zym Labs in your providerGive Cloud the connection detailsCheck the attributesTest a sign-inTurn it onWhat's next