Set up OpenID Connect (OIDC) to let users sign in to Ironclad through your organization’s identity provider. OIDC is available alongside SAML and supports just-in-time (JIT) user provisioning.
Use Case
Use this article when your organization wants to authenticate Ironclad users through an OIDC-compatible identity provider, such as Okta, Microsoft Entra ID, or Google Workspace.
Prerequisites
| Features |
OIDC SSO |
| Connected Systems |
An OIDC-compatible identity provider, such as Okta, Microsoft Entra ID, or Google Workspace. |
| Permissions |
An Ironclad admin and admin access to your identity provider. |
Release: This article describes features and functionality planned for our October release. Some features may not be available until October 8, 2026.
Step 1: Obtain OIDC Credentials
Register Ironclad as an OIDC web application in your identity provider, then obtain the following information:
Issuer URL
Client ID
Client secret
Any additional scopes required by your identity provider.
For provider-specific instructions, refer to the documentation for your identity provider:
Microsoft Entra ID: How to add a redirect URI to your application
Google Workspace: Create access credentials
You'll return to this identity provider configuration later in Step 3: Configure the Callback URL in your IdP.
Step 2: Add an OIDC Configuration in Ironclad
In Ironclad:
Click your profile icon in the upper right corner, and select Company Settings.
Select Integrations from the left side panel.
-
Under the Identity and Access Management section, click Single Sign-On (SSO).
Select the OIDC tab.
-
Click Add Configuration to open the New connection settings form.
Leave the Enabled checkbox clear while you configure and test the connection. You'll turn this setting on in Step 4: Enable the Configuration in Ironclad.
In the Connection name field, enter a descriptive name for the connection.
-
Enter the values supplied by your identity provider in the following fields:
Issuer URL
Client ID
Client Secret
(Optional) Enter any additional scopes required by your IdP.
To retrieve additional profile data when user attributes are missing from the initial login token, select the Always call UserInfo endpoint checkbox.
To allow eligible users to be provisioned when they sign in, select the Enable JIT Provisioning checkbox.
Click Test connection.
Verify that Connected to IdP appears.
Click Save.
The Callback URL becomes available after saving the configuration.
Step 3: Configure the Callback URL in your IdP
Warning: Enabling the connection without setting up a callback URL first could cause errors that prevent users from completing the sign-in process.
The Callback URL tells your identity provider where to return a user after authentication. Depending on which IdP you use, the callback URL may also be referred to as a redirect URI, authorized redirect URI, or sign-in redirect URI.
- After saving your configuration in Ironclad, copy the Callback URL to your clipboard.
- Note: Don't edit the callback URL. The value configured in your IdP must match the value displayed in Ironclad exactly.
- Open the OIDC configuration you created for Ironclad in Step 1: Obtain OIDC Credentials.
- Add the Ironclad callback URL using the label for your identity provider:
- Okta: Sign-in redirect URIs
- Microsoft Entra ID: Redirect URIs
- Google Workspace: Authorized redirect URIs
- Save the IdP configuration.
For provider-specific instructions, refer to the documentation linked in Step 1: Obtain OIDC Application Credentials.
Step 4: Enable the Configuration in Ironclad
In Ironclad:
- Navigate back to the OIDC tab under Company Settings > Integrations > Single Sign-On (SSO).
- Select the Enabled checkbox.
- Click Save.
Users assigned to this configuration can now sign in through the OIDC identity provider.
Resources
Explore articles, courses, and support options to get the most out of Ironclad.