SSO & OIDC Discovery

Set up native Single Sign-On (SSO) using OpenID Connect discovery for Microsoft Entra ID, Okta, Google Workspace, Keycloak, or Auth0.
Categories:

Single Sign-On (SSO) with OpenID Connect

psLens supports native Single Sign-On (SSO) via OpenID Connect (OIDC). Instead of manually entering authorization and token endpoints in YAML files, psLens provides an automated discovery tool at /settings/auth that queries /.well-known/openid-configuration directly from your Identity Provider.

Setting Up Single Sign-On in psLens

  1. Navigate to Settings → Authentication & SSO (/settings/auth).

  2. Set the login method to Native OIDC / Single Sign-On.

  3. Choose your Identity Provider preset or enter the Issuer URL:

    • Microsoft Entra ID (Azure AD): https://login.microsoftonline.com/{TENANT_ID}/v2.0
    • Okta: https://{YOUR_OKTA_DOMAIN}.okta.com
    • Google Workspace: https://accounts.google.com
    • Keycloak: https://{KEYCLOAK_HOST}/realms/{REALM_NAME}
    • Auth0: https://{TENANT}.auth0.com/

  4. Click Discover Endpoints: psLens validates the connection and auto-detects endpoints, supported scopes, and token claim attributes.

  5. In your Identity Provider’s App Registration console, register the exact Redirect URI displayed on the page:

    https://your-pslens-domain.com/auth/callback

  6. Paste the Client ID and Client Secret.

  7. (Optional) Specify Allowed Groups (e.g. pslens-admins) to enforce role-based access control.

  8. Click Save Authentication Settings. Changes take effect immediately without restarting psLens.

Supported Group Claims & RBAC

When verifying OIDC tokens, psLens extracts group memberships from the ID token claim defined in groupClaim (defaulting to groups or roles). If allowedGroups is configured, only users belonging to at least one listed group will be granted access upon successful authentication.