SSO & OIDC Discovery

Set up native Single Sign-On (SSO) using OpenID Connect discovery for Microsoft Entra ID, Okta, Google Workspace, Keycloak, or Auth0.
Categories:

Single Sign-On (SSO) with OpenID Connect

psLens supports native Single Sign-On (SSO) via OpenID Connect (OIDC). Instead of manually entering authorization and token endpoints in YAML files, psLens provides an automated discovery tool at /settings/auth that queries /.well-known/openid-configuration directly from your Identity Provider.

Setting Up Single Sign-On in psLens

  1. Navigate to Settings → Authentication & SSO (/settings/auth).

  2. Set the login method to Native OIDC / Single Sign-On.

  3. Choose your Identity Provider preset or enter the Issuer URL:

    • Microsoft Entra ID (Azure AD): https://login.microsoftonline.com/{TENANT_ID}/v2.0
    • Okta: https://{YOUR_OKTA_DOMAIN}.okta.com
    • Google Workspace: https://accounts.google.com
    • Keycloak: https://{KEYCLOAK_HOST}/realms/{REALM_NAME}
    • Auth0: https://{TENANT}.auth0.com/

  4. Click Discover Endpoints: psLens tests the connection and detects endpoints, supported scopes, and token claim attributes.

  5. In your Identity Provider’s App Registration console, register the exact Redirect URI shown on the page:

    https://your-pslens-domain.com/auth/callback

  6. Paste the Client ID and Client Secret.

  7. (Optional) Specify Allowed Groups (such as pslens-admins) to enforce role-based access control.

  8. Click Save Authentication Settings. Changes take effect immediately without restarting psLens.

Supported Group Claims & RBAC

When checking OIDC tokens, psLens extracts group memberships from the ID token claim defined in groupClaim (defaulting to groups or roles). If you configure allowedGroups, only users belonging to at least one listed group gain access upon authentication.