Identity provider guides

These guides cover the settings Odin needs in each identity provider (IdP). Copy the ACS (Single Sign-On) URL, SP Entity ID / Audience or Redirect URL from Organisation Settings → Single Sign-On wherever the guide says so. For directory sync, use the SCIM endpoint and SCIM bearer token from directory sync. Other standards-compliant SAML 2.0 and OIDC providers work with the generic requirements. Google Workspace and OneLogin guides will follow.

​

Okta

​

SAML

​

Single logout

Okta supports SAML single logout with Odin over the HTTP-POST binding.

1. In the app’s SAML settings, open Show Advanced Settings, tick Enable Single Logout and Allow application to initiate Single Logout.
2. Set Single Logout URL to the ACS host followed by /api/logout/callback. For example, if the ACS URL is https://sso.borghq.io/api/oauth/saml, use https://sso.borghq.io/api/logout/callback.
3. Set SP Issuer to the Odin SP Entity ID / Audience.
4. Upload the Signature Certificate from the ACS host’s /.well-known/saml.cer, for example https://sso.borghq.io/.well-known/saml.cer.
5. Download the app’s metadata XML, delete the SingleLogoutService element whose binding is HTTP-Redirect, and paste the XML into Odin under …or paste metadata XML.

​

OIDC

1. Create App Integration → OIDC - OpenID Connect → Web Application.
2. Sign-in redirect URIs: the Odin Redirect URL. Grant type: Authorization Code.
3. Assign people on the Assignments tab.
4. In Odin, use the discovery URL https://<your-okta-domain>/.well-known/openid-configuration, with the app’s Client ID and Client secret.

​

Directory sync

1. In Odin, create a directory with provider Okta SCIM 2.0.
2. In Okta, add a SCIM-capable app such as SCIM 2.0 Test App (OAuth Bearer Token) from the catalogue, or enable SCIM provisioning on your Odin app.
3. On Provisioning → Integration, enable the API integration. Set the SCIM 2.0 Base Url to the Odin SCIM endpoint and the OAuth Bearer Token to the Odin SCIM bearer token, then select Test API Credentials and save.
4. On Provisioning → To App, enable Create Users, Update User Attributes and Deactivate Users. Leave Sync Password off.
5. Assign people or groups. For role mapping, add the mapped groups on Push Groups.

​

Microsoft Entra ID

​

SAML

​

OIDC

1. Go to App registrations → New registration. Choose Accounts in this organizational directory only and add a Web redirect URI set to the Odin Redirect URL.
2. Under Certificates & secrets, create a client secret.
3. Under Token configuration, add the optional ID-token claims email, given_name and family_name.
4. Under API permissions, make sure openid, profile and email are granted, and grant admin consent.
5. To restrict access, open the matching Enterprise application, set Assignment required? to Yes, and assign people.
6. In Odin, use https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration with the Application (client) ID and the client secret.

​

Directory sync

1. In Odin, create a directory with provider Microsoft Entra ID SCIM 2.0.
2. In your Entra Enterprise application, open Provisioning, set Provisioning Mode to Automatic, and enter the Odin SCIM endpoint as Tenant URL and the SCIM bearer token as Secret Token. Select Test Connection, save, and start provisioning.
3. Entra sends each person’s mail as their work email. People without a mail value are sent with their sign-in name, and Odin ignores them unless that name is on a verified domain.
4. Entra provisions everyone assigned to the application. Assigning groups, which role mapping needs, requires Microsoft Entra ID P1 or higher. On Entra ID Free, leave Directory manages roles off and manage roles in Odin.

​

Auth0

​

SAML

1. Applications → Create Application → Regular Web Applications.
2. On Addons, enable SAML2 Web App. Set Application Callback URL to the Odin ACS (Single Sign-On) URL.
3. In Settings, set:
   {
     "audience": "<Odin SP Entity ID / Audience>",
     "recipient": "<Odin ACS URL>",
     "destination": "<Odin ACS URL>",
     "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
     "nameIdentifierProbes": ["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
   }
   
   Do not add a logout block: single logout with Auth0 is not supported yet.
4. Enable your user connection for the application on its Connections tab.
5. In Odin, use the metadata URL https://<your-tenant>/samlp/metadata/<client-id>.

​

OIDC

1. Applications → Create Application → Regular Web Applications.
2. Allowed Callback URLs: the Odin Redirect URL.
3. Credentials → Authentication Method: Client Secret (Basic).
4. In Odin, use https://<your-tenant>/.well-known/openid-configuration with the Client ID and Client Secret.

​

JumpCloud

​

SAML

1. Go to SSO Applications → Add New Application → Custom Application.
2. Select Manage Single Sign-On (SSO) with Configure SSO with SAML. Also select Export users to this app (Provisioning) if you want directory sync.
3. On the SSO tab, set:
   • IdP Entity ID: any unique value, for example your console URL followed by /odin
   • SP Entity ID: the Odin SP Entity ID / Audience
   • ACS URL: the Odin ACS (Single Sign-On) URL
   • SAMLSubject NameID: email, with format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
   • Attributes: email → email, firstName → firstname, lastName → lastname
4. Grant access by binding User Groups to the application.
5. Select Export Metadata and paste the XML into Odin. JumpCloud does not publish a metadata URL.

JumpCloud does not offer SAML single logout. Odin signs people out of Odin only.

​

Directory sync

1. In Odin, create a directory with provider JumpCloud SCIM 2.0.
2. On the application’s Provisioning tab, choose SCIM API with Bearer token. Enter the Odin SCIM endpoint as Base URL and the SCIM bearer token as Token Key.
3. Enter an unused Test User Email and Test User Group Name, pick a Source User and Source User Group, then select Test Connection and Activate.
4. User groups bound to the application are pushed to Odin. Name them to match your role mapping, for example Odin-Admins.

​

Keycloak

​

SAML

1. In your realm, go to Clients → Create client. Choose SAML and set Client ID to the Odin SP Entity ID / Audience.
2. Set Valid redirect URIs and Assertion Consumer Service POST Binding URL to the Odin ACS (Single Sign-On) URL.
3. Set Name ID format to email and turn on Force name ID format.
4. On the Keys tab, turn Client signature required off. Odin’s SSO service does not sign authentication requests yet, so Keycloak otherwise answers “Invalid requester”.
5. On Client scopes → Mappers, add User Property mappers for email, firstName and lastName, with SAML attribute names matching those properties.
6. In Odin, use the metadata URL https://<keycloak-host>/realms/<realm>/protocol/saml/descriptor.

Single logout with Keycloak is not supported yet. Odin signs people out of Odin only.