# SSO & OIDC Discovery

> Set up native Single Sign-On (SSO) using OpenID Connect discovery for Microsoft Entra ID, Okta, Google Workspace, Keycloak, or Auth0.

---

Site [llms.txt](/llms.txt)

---

## Single Sign-On (SSO) with OpenID Connect

psLens supports native Single Sign-On (SSO) via OpenID Connect (OIDC). Instead of manually entering authorization and token endpoints in YAML files, psLens provides an automated discovery tool at `/settings/auth` that queries `/.well-known/openid-configuration` directly from your Identity Provider.

### Setting Up Single Sign-On in psLens

1. Navigate to **Settings → Authentication & SSO** (`/settings/auth`).
2. Set the login method to **Native OIDC / Single Sign-On**.
3. Choose your Identity Provider preset or enter the **Issuer URL**:
   - **Microsoft Entra ID (Azure AD):** `https://login.microsoftonline.com/{TENANT_ID}/v2.0`
   - **Okta:** `https://{YOUR_OKTA_DOMAIN}.okta.com`
   - **Google Workspace:** `https://accounts.google.com`
   - **Keycloak:** `https://{KEYCLOAK_HOST}/realms/{REALM_NAME}`
   - **Auth0:** `https://{TENANT}.auth0.com/`
4. Click **Discover Endpoints**: psLens tests the connection and detects endpoints, supported scopes, and token claim attributes.
5. In your Identity Provider's App Registration console, register the exact **Redirect URI** shown on the page:

   ```text
   https://your-pslens-domain.com/auth/callback
   ```

6. Paste the **Client ID** and **Client Secret**.
7. *(Optional)* Specify **Allowed Groups** (such as `pslens-admins`) to enforce role-based access control.
8. Click **Save Authentication Settings**. Changes take effect immediately without restarting psLens.

### Supported Group Claims & RBAC

When checking OIDC tokens, psLens extracts group memberships from the ID token claim defined in `groupClaim` (defaulting to `groups` or `roles`). If you configure `allowedGroups`, only users belonging to at least one listed group gain access upon authentication.