OpenID Connect (OIDC) lets enterprise customers use an OIDC identity provider for single sign-on to Ironclad. OIDC is available alongside SAML and supports identity providers such as Okta, Microsoft Entra ID, and Google Workspace. OIDC also supports just-in-time (JIT) user provisioning.
Use Case
Use this overview to understand whether OIDC is the appropriate SSO method for your organization before configuring an identity provider.
Prerequisites
| Features |
OIDC SSO |
| Connected Systems |
An OIDC-compatible identity provider, such as Okta, Microsoft Entra ID, or Google Workspace. |
| Permissions |
An admin must configure the identity provider connection and assign users. |
Release: This article describes features and functionality planned for our October release. Some features may not be available until October 8, 2026.
What Is OIDC?
OpenID Connect is an authentication protocol built on OAuth 2.0. It uses JSON-based messages to allow an application to verify a user’s identity through an identity provider.
In Ironclad, OIDC provides an alternative to SAML for enterprise single sign-on. Your identity provider authenticates the user, and Ironclad uses the OIDC response to sign the user in.
How OIDC Works in Ironclad
At a high level, the sign-in process works as follows:
- An end user starts an Ironclad sign-in session.
- Ironclad sends the user to the configured OIDC identity provider.
- The identity provider authenticates the user and returns the OIDC response to Ironclad.
- Ironclad validates the response and signs the user in.
- If JIT provisioning is enabled for the configuration, Ironclad can provision the user during the sign-in process.
The exact sign-in and provisioning behavior depends on the configuration supported by your organization and identity provider.
Supported Identity Providers
The current OIDC release scope identifies the following identity providers:
- Okta
- Microsoft Entra ID, formerly Azure AD
- Google Workspace
OIDC vs. SAML
OIDC and SAML are separate authentication methods. OIDC does not replace SAML. Enterprise administrators can use the method that matches their identity provider and authentication requirements.
| Capability | OIDC | SAML |
|---|---|---|
| Authentication method | JSON-based protocol built on OAuth 2.0 | XML-based federation protocol |
| Identity provider configuration | OIDC configuration | SAML configuration |
| Single sign-on | Yes | Yes |
| JIT provisioning | Supported | Availability depends on the SAML configuration |
User Provisioning
OIDC supports just-in-time (JIT) user provisioning. With JIT provisioning, an eligible user can be provisioned when they sign in through the configured identity provider.
User assignment, group membership, and Ironclad permissions depend on your identity provider and Ironclad configuration.
Availability and Limitations
- OIDC availability depends on your organization’s rollout and enablement status.
- Your identity provider must support the OIDC configuration required by Ironclad.
- OIDC is available alongside SAML. The two authentication methods use separate configurations.
Frequently Asked Questions
Does OIDC replace SAML?
No. OIDC is an additional SSO authentication method. Existing SAML configurations remain separate.
Which users can configure OIDC?
Admins configure OIDC connections and assign users.
Can OIDC provision users automatically?
OIDC supports just-in-time (JIT) user provisioning. When JIT provisioning is enabled, an eligible user can be provisioned during the sign-in process.
Can users continue to use SAML?
Yes. OIDC is available alongside SAML and does not replace existing SAML support.
Resources
Explore articles, courses, and support options to get the most out of Ironclad.