Install Pando

OpenID Connect

oidc Sign in through any OpenID Connect provider: Okta, Microsoft Entra ID, Google Workspace, Keycloak, Authentik and others.

Setup

  1. Create an app integration

    1. In the Admin Console, open Applications and Resources → Applications.
    2. Choose Create App Integration, then Classic experience.
    3. Choose OIDC - OpenID Connect, then Web Application, then Next.
    4. Set Sign-in redirect URIs to <callback URL>.
    5. Under Assignments, choose who can sign in, then choose Save.
    6. On the General tab, copy the Client ID and the client secret.

    Okta OIDC app integrations

    Settings issuer, client_id, client_secret

  2. Add a groups claim

    1. On the app's Sign On tab, choose Edit under OpenID Connect ID Token.
    2. Set Group claims filter to groups, Matches regex and .*, then choose Save.

    Okta groups claim

    Settings groups_claim

The console shows the callback URL and entity ID, and pando identity-provider add prints them.

Settings (13)
issuerIssuer URLRequired

The provider's issuer. Pando reads <issuer>/.well-known/openid-configuration for the rest.

string · For example https://example.okta.com

client_idClient IDRequired

The client ID of the web application you registered for Pando.

string

client_secretClient secretCredential

The application's client secret. Stored encrypted and never shown again.

string

scopesScopesAdvanced

Space-separated. Add groups if your provider needs a scope to send them.

string · Default openid email profile

groups_claimGroups claim

The claim that lists the person's groups. Each one becomes a synced group in Pando.

string · Default groups

subject_claimSubject claimAdvanced

The claim that identifies a person and never changes. Microsoft Entra ID needs oid.

string · Default sub

username_claimUsername claimAdvanced

The claim holding the person's username in Pando.

string · Default preferred_username

email_claimEmail claimAdvanced

The claim holding the person's email address.

string · Default email

name_claimName claimAdvanced

The claim holding the person's display name. When it is empty, given_name and family_name are used.

string · Default name

hosted_domainGoogle Workspace domain

Only accept Google accounts from this domain. Without it, anyone with a Google account can sign in.

string · For example example.com

promptPrompt

Ask the provider to always show its sign-in form or account chooser.

  • (empty) Provider's choice
  • login Always ask for credentials
  • select_account Always offer an account choice

one of the values above

disable_userinfoSkip the userinfo endpointAdvanced

Use only the ID token's claims. By default Pando fills in missing claims from userinfo.

bool

session_max_lifetimeSession lengthAdvanced

How long a sign-in lasts. Without SCIM this is also how long access can outlive its removal at the provider.

string · Default 12h