Set up SSO with your IdP

This tutorial configures OIDC single sign-on so your team signs in through your identity provider. You need to be an Org Admin, and your IdP must support OIDC discovery. Make sure CC_DATA_KEY is configured on the deployment (it encrypts the client secret).

1. 1
   Register Cloud Control at your IdP

   Create an OIDC application (web/confidential client). Set the redirect URI to https://<your-console-host>/api/auth/oidc/callback. Note the issuer URL, client id and client secret.

2. 2
   Save the config in Cloud Control

   In the console's SSO settings, or via `POST /api/org/sso`, enter the issuer, client id, client secret, a default role (for example Viewer), and the email domains that should use this IdP (for example acme.io).

   

3. 3
   Let discovery validate it

   On save, Cloud Control runs OIDC discovery against your issuer and stores the resolved endpoints. A wrong issuer fails here with a clear message — fix it before anyone tries to sign in.

4. 4
   Test the login flow

   Sign out, go to /login, and start SSO with a work email whose domain you configured. You are redirected to your IdP (with state, nonce and PKCE), authenticate, and are redirected back.

   

5. 5
   Confirm JIT provisioning

   A user who did not previously exist is provisioned automatically with the default role you chose. Check the Team page to see them appear.

6. 6
   Enable or disable later

   Toggle SSO with `PATCH /api/org/sso`. Rotate the secret by POSTing a new one; leave the secret field blank to keep the existing envelope while editing other fields.