# SSO & OIDC Discovery

> Set up native Single Sign-On (SSO) using OpenID Connect discovery for Microsoft Entra ID, Okta, Google Workspace, Keycloak, or Auth0.

---

LLMS index: [llms.txt](/llms.txt)

---

## Single Sign-On (SSO) with OpenID Connect

psLens supports native Single Sign-On (SSO) via OpenID Connect (OIDC). Instead of manually entering authorization and token endpoints in YAML files, psLens provides an automated discovery tool at `/settings/auth` that queries `/.well-known/openid-configuration` directly from your Identity Provider.

### Setting Up Single Sign-On in psLens

1. Navigate to **Settings → Authentication & SSO** (`/settings/auth`).
2. Set the login method to **Native OIDC / Single Sign-On**.
3. Choose your Identity Provider preset or enter the **Issuer URL**:
   - **Microsoft Entra ID (Azure AD):** `https://login.microsoftonline.com/{TENANT_ID}/v2.0`
   - **Okta:** `https://{YOUR_OKTA_DOMAIN}.okta.com`
   - **Google Workspace:** `https://accounts.google.com`
   - **Keycloak:** `https://{KEYCLOAK_HOST}/realms/{REALM_NAME}`
   - **Auth0:** `https://{TENANT}.auth0.com/`
4. Click **Discover Endpoints**: psLens validates the connection and auto-detects endpoints, supported scopes, and token claim attributes.
5. In your Identity Provider's App Registration console, register the exact **Redirect URI** displayed on the page:

   ```text
   https://your-pslens-domain.com/auth/callback
   ```

6. Paste the **Client ID** and **Client Secret**.
7. *(Optional)* Specify **Allowed Groups** (e.g. `pslens-admins`) to enforce role-based access control.
8. Click **Save Authentication Settings**. Changes take effect immediately without restarting psLens.

### Supported Group Claims & RBAC

When verifying OIDC tokens, psLens extracts group memberships from the ID token claim defined in `groupClaim` (defaulting to `groups` or `roles`). If `allowedGroups` is configured, only users belonging to at least one listed group will be granted access upon successful authentication.