--- title: "OpenID Connect" slug: "openid-connect" updated: 2024-05-20T06:19:46Z published: 2024-05-20T06:19:46Z canonical: "help.symphonysummitai.com/openid-connect" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.symphonysummitai.com/llms.txt > Use this file to discover all available pages before exploring further. # OpenID Connect **OpenID Connect** **Authentication** enables seamless login into several web applications and provides a standardized method for clients to authenticate users and obtain basic profile information about them. It's commonly used for Single Sign-On (SSO) and federated identity scenarios. Add OpenID Connect Authentication **To add a new** **OpenID Connect** **Configuration****, perform the following steps to define the general properties:** ### General Properties 1. Navigate to **Platform Studio** > **Access Control Center** > **Add** **Authentication** > **OpenID**. 2. Select **OpenID** from the **Authentication Types**. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704456997900.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D)Figure: Add OpenID Connect Configuration 3. Click **Add OpenID Configuration** to add a new instance for **Authentication** type. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704457191657.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D) Figure: Add OpenID 4. Click **Next** to move to the next screen to enter the configuration details.  ### Create User If OpenID Connect Tab is selected, the screen appears below. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704457318386.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D) Figure: OpenID Connect configuration screen The table shows the list of attributes for enabling the **OpenID Connect** **Configuration**. Field Description | Field | Description | | --- | --- | | Name | Specify a name for the OpenID configuration in the **Name** field. | | Logo* | You can upload the Logo for SAML configuration here. Choose the image for Logo and click the **Uplo****ad**. | | Login Type | Specify the type of Login. You can select **Basic** or **Advanced** from the drop-down list. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704457722316.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D)Figure: Login Type | | Grant Type* | Select the Grant Type either as **Authorization Code** or **Implicit** by expanding the Grant Type drop-down list. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704457785883.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D)Figure: Grant Type | | Client ID* | Specify the public identifier. This is the Application ID from the Okta portal. | | Issuer* | Type the URL of Issuer OpenID. | | Redirect URL* | Type the Redirect URL here. This is the same URL you have specified in the Redirect URL field of the Okta portal. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1678873992705.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D)Figure: Redirect URL | | Scope | Specify the Scope of authentication (openid profile email). | | Response Attribute* | Select **Response Attribute** either as **Email** or **User Principal Name** by expanding the drop-down list.Note In OpenID Connect (OIDC), the Response Attribute includes details about the authenticated user. The types of Response Attributes are: - Email Address: This is a standard attribute many applications use for communication and identification. When a client application requests the user's email address, it typically includes the email scope in the authorization request. The OpenID Provider(OP) then includes the user's email address in the response, allowing the client application to access it. - User Principal Name (UPN): The UPN is a user identifier associated with Microsoft Active Directory. It usually takes the form of an email-like address, such as username@domain.com. However, unlike the email address, the UPN is specific to the user's identity within the Active Directory domain. | | Two Factor Authentication | Enable the check for Two Factor Authentication.![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1691992149610.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D)Figure: Check box If you click **Two Factor Authentication**, you can choose the type of **Login Type** from the field list. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704374141461.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D)Figure: Enable Two Factor Authentication | | Create User | Enable the box ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1691992230403.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D) to create user. Specify the **Timezone** from the drop-down list. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704374260872.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D)Figure: Timezone ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704374364463.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D)Figure: Timezone list Select the Roles for the User from the drop-down list. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704374610398.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D)Figure: Roles | 5. Click **Save** to save the configuration entered in the field. ![](https://cdn.document360.io/62351b42-cfbd-43ad-8ce1-82b8f455337f/Images/Documentation/image-1704458360239.png?sv=2026-02-06&spr=https&st=2026-11-05T12%3A27%3A08Z&se=2026-11-05T13%3A27%3A08Z&sr=c&sp=r&sig=zVSUhi9N3FLAXcMbBdvjBWtBSv2MSNt82SLJVdjyPhg%3D)Figure: OpenID Connect Configuration URL used for redirecting the User to specific page after SSO. **Note** - Image width should be less than 300px. - Image height should be less than 48px. - Supported Image format: .gif, .jpeg, .jpg, .png, .bmp. URL that identifies your OpenID Identity provider. **Note** - Image width should be less than 300px. - Image height should be less than 48px. - Supported Image format: .gif, .jpeg, .jpg, .png, .bmp. Grant Type dictates how the client application obtains the access token from the authorization server. - Authorization Code is recommended for server-side applications. It involves redirecting the user for authentication and authorization, then exchanging the returned authorization code for an access token securely. This process, completed on the server side, enhances security. - Implicit is ideal for client-side applications, by providing the access token directly after user authentication. URL that identifies your OpenID Identity provider. URL used for redirecting the User to specific page after SSO. It specifies the level of access and the types of information that the client application is requesting from the OpenID Connect provider (OP) about the authenticated user. Type of scopes are: 1. openid: Indicates that the client is requesting basic OpenID Connect authentication services. 2. profile: It requests access to the user's basic profile information. 3. email: It allows client application to retrieve user's email address, facilitating communication, identification.