> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://help.simplyprint.io/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # Set up OpenID Connect (OIDC) single sign-on with any identity provider # Set up OpenID Connect (OIDC) single sign-on with any identity provider SimplyPrint works with any standards-compliant OpenID Connect provider, not just the ones with a dedicated preset. This guide covers the universal setup pattern you can follow with Keycloak, Authentik, OneLogin, Ping Identity, and similar providers using the **Other** preset. || Single sign-on is included in the Enterprise and School plans. Print Farm subscribers from before 2026-05-15 are grandfathered in. You can compare plans on the [pricing page](https://simplyprint.io/pricing). If your provider is Microsoft Entra ID, Google Workspace, Okta, or Auth0, use the dedicated guides instead, they pre-fill or spell out provider-specific defaults: [Microsoft Entra ID](https://help.simplyprint.io/en/article/set-up-microsoft-entra-id-single-sign-on-oidc-for-simplyprint-18njqht/), [Google Workspace](https://help.simplyprint.io/en/article/set-up-google-workspace-single-sign-on-oidc-for-simplyprint-kzzldz/), [Okta](https://help.simplyprint.io/en/article/set-up-okta-single-sign-on-oidc-for-simplyprint-1hbzagz/), and [Auth0](https://help.simplyprint.io/en/article/set-up-auth0-single-sign-on-oidc-for-simplyprint-1ne9os1/). For a plain-language overview of how organization OIDC works in SimplyPrint, see the [OIDC single sign-on overview](https://help.simplyprint.io/en/article/set-up-openid-connect-oidc-single-sign-on-for-simplyprint-1bypz64/). For SAML, or to compare the two, see the [single sign-on overview](https://help.simplyprint.io/en/article/single-sign-on-sso-for-simplyprint-overview-and-setup-guides-16o3fy7/). ## How OIDC connections work The connection is the same for every provider. SimplyPrint is the relying party (the app signing users in), and your identity provider is the OIDC server that holds the accounts. SimplyPrint uses the standard authorization-code flow with PKCE. You only need three things from your provider: - The **issuer URL** (the base URL whose `/.well-known/openid-configuration` document lists all the endpoints). - A **client ID**. - A **client secret**. SimplyPrint reads the issuer's discovery document and auto-fills the authorization, token, JWKS, userinfo, and logout endpoints for you. You do not paste those in by hand unless your provider does not publish a discovery document. ## Before you start A few requirements to check: - You need to be an account admin with the user registration settings permission. - Each account runs **one** SSO method at a time, either SAML or OIDC. Turning on OIDC deactivates SAML (your saved SAML config is kept), and vice versa. - You need admin access to your identity provider so you can register a new application and read back the issuer and credentials. ## Step 1: Copy your redirect URI from SimplyPrint You will register a redirect URI (also called a callback or reply URL) with your provider, so grab it from SimplyPrint first. 1. Go to [Settings -> Organization](https://simplyprint.io/panel/settings/organization#registration) and open **User registration & SSO**. 2. Tick **OpenID Connect (OIDC) single sign-on**. 3. Click **Configure OIDC single sign-on**. 4. Select the **Other** tab at the top of the modal. 5. Under **What you need from us**, click **Copy** next to **Redirect URI**. | Copy the exact redirect URI shown in your modal. It is your SimplyPrint site URL followed by `/oauth/callback`. Do not type it from memory, paste the value SimplyPrint gives you. ## Step 2: Create an OIDC client in your identity provider The labels differ between providers, but the pattern is the same everywhere. 1. In your provider's admin console, create a new application, client, or integration of type **OIDC** (sometimes called "OpenID Connect" or "web application"). 2. Choose the **authorization code** grant / flow. This is the standard web-app flow. Avoid "implicit" or "SPA / public client" types, SimplyPrint needs a confidential client with a secret. 3. Set the **redirect URI** (callback / reply URL) to the value you copied in step 1. 4. Make sure the scopes `openid`, `profile`, and `email` are allowed for the client. 5. Save, then note the **client ID** and **client secret** the provider generates. ### Finding your issuer URL The issuer is the base URL, not the discovery URL. If your provider gives you a discovery URL ending in `/.well-known/openid-configuration`, the issuer is everything before that suffix. Two common examples: - **Keycloak:** the issuer is `https:///realms/`. The discovery document lives at `https:///realms//.well-known/openid-configuration`. Older Keycloak versions include an extra `/auth` segment: `https:///auth/realms/`. - **Authentik:** each provider has its own issuer, usually `https:///application/o//`. When in doubt, open `/.well-known/openid-configuration` in a browser. If it returns a JSON document with an `issuer` field, that `issuer` value is exactly what you paste into SimplyPrint. ## Step 3: Enter the details in SimplyPrint Back in the OIDC modal on the **Other** tab, fill in the **What we need from you** section. 1. Paste your **Issuer URL**. It must start with `https://`. 2. Click **Check**. SimplyPrint fetches the discovery document and shows the resolved endpoints (authorization, token, JWKS, and so on). A green "Discovery document looks good" message confirms the issuer is reachable and valid. 3. Enter your **Client ID**. 4. Enter your **Client secret**. Once saved, the field shows **Unchanged**, leave it blank on future edits to keep the stored secret, or type a new one to replace it. 5. Leave **Scopes** as the default `openid profile email` unless your provider needs more. 6. Click **Save**. ||| If **Check** fails, the issuer URL is usually wrong. Make sure it is the base issuer (no `/.well-known/openid-configuration` suffix) and that the discovery document's own `issuer` value matches exactly, SimplyPrint rejects a mismatch as a safety measure. ## Step 4: Map claims to user fields SimplyPrint needs to know which claims from your provider hold each user's details. Under **Claim mappings**, the defaults are: - `email` -> email - `given_name` -> first name - `family_name` -> last name Most providers send these standard claims, so the defaults usually work as-is. Adjust a row if your provider uses a different claim name. To map your provider's groups to SimplyPrint user groups, add a mapping from your group claim (commonly `groups`) to **user groups**, and make sure your client is configured to include that claim. The concept is the same as SAML group mapping, see [SSO user groups and group mapping](https://help.simplyprint.io/en/article/saml-single-sign-on-user-groups-group-mapping-and-teacher-mapping-lfgz7/). ## Step 5: Test the connection Save your settings first, then use **Test sign-in** to verify everything end to end without affecting any accounts. 1. In the modal, click **Test sign-in**. SimplyPrint opens a new tab and runs the real OIDC flow against your provider. 2. Sign in with a test user at your provider. 3. SimplyPrint shows the claims it received and flags any required claim that is missing. Nobody is logged in and no account is created, it is a safe dry run. | Test sign-in is the fastest way to confirm a connection and see the exact claim names your provider sends. Use those names to correct your claim mappings if anything is missing. ## New members and automatic account creation When a member signs in for the first time, SimplyPrint creates their account automatically as long as their email is trustworthy. An email is trusted when: - your provider marks the email as verified, or - the email's domain is one your account has verified (see [verified email domains for SSO](https://help.simplyprint.io/en/article/verify-your-email-domains-for-single-sign-on-g24cgc/)), or - an admin turned off **Require verified email** in the modal's **Advanced** section. If none of those apply, the sign-in is refused with a clear message so no unverified account is created. Verifying your email domains is the recommended fix for providers that do not send a verified-email signal. ## Providers without a discovery document A small number of providers do not publish a `/.well-known/openid-configuration` document. For those, open the **Advanced** section in the modal and fill in the endpoints manually: - Authorization endpoint - Token endpoint - JWKS URI - Userinfo endpoint - End session endpoint (for single logout) Leave any of these blank to keep using the discovery document. The Advanced section also holds extra authorization request parameters (such as `prompt`), an **Allowed email domains** restriction, and the **Require verified email** toggle. The **End session endpoint** also controls sign-out: when your provider advertises a logout endpoint, SimplyPrint signs the user out of your provider too (RP-initiated logout). If it does not, signing out of SimplyPrint ends only the SimplyPrint session, and the provider session stays active until it expires or the user signs out there. ## Troubleshooting The modal has two debug panels that are your main troubleshooting tools: - **Last received claims** shows the most recent claims your provider sent (email addresses are masked). Use it to confirm the claim names match your mappings. - **Last sign-in error** shows the most recent failure, such as a missing claim or a token validation problem. For a full list of errors and fixes, see [Troubleshooting OIDC single sign-on](https://help.simplyprint.io/en/article/troubleshoot-openid-connect-oidc-sign-in-cyos2f/). ## Related articles - [Single sign-on (SSO) overview and setup guides](https://help.simplyprint.io/en/article/single-sign-on-sso-for-simplyprint-overview-and-setup-guides-16o3fy7/) - [OpenID Connect (OIDC) single sign-on overview](https://help.simplyprint.io/en/article/set-up-openid-connect-oidc-single-sign-on-for-simplyprint-1bypz64/) - [Set up OIDC with Auth0](https://help.simplyprint.io/en/article/set-up-auth0-single-sign-on-oidc-for-simplyprint-1ne9os1/) - [Verified email domains for SSO](https://help.simplyprint.io/en/article/verify-your-email-domains-for-single-sign-on-g24cgc/) - [Troubleshooting OIDC single sign-on](https://help.simplyprint.io/en/article/troubleshoot-openid-connect-oidc-sign-in-cyos2f/) - [Set up OIDC with Microsoft Entra ID](https://help.simplyprint.io/en/article/set-up-microsoft-entra-id-single-sign-on-oidc-for-simplyprint-18njqht/) - [Set up OIDC with Okta](https://help.simplyprint.io/en/article/set-up-okta-single-sign-on-oidc-for-simplyprint-1hbzagz/) - [Set up SAML single sign-on (SSO) for SimplyPrint](https://help.simplyprint.io/en/article/set-up-single-sign-on-sso-for-simplyprint-4coj1g/) - [Linking your existing SimplyPrint account to your SSO account](https://help.simplyprint.io/en/article/linking-your-existing-simplyprint-account-to-your-sso-account-5pw0aj/) - [Signing in with SSO (organization login)](https://help.simplyprint.io/en/article/signing-in-with-sso-organization-login-1v0eb2h/)