# OIDC

Configure OpenID Connect single sign-on for a status dashboard.

Source: https://statusdashboard.com/docs/status-dashboards/sso/oidc

OpenID Connect connects a status dashboard to OIDC-compliant identity providers such as Okta, Entra ID, or Auth0. Configure redirect URI, scopes, and client credentials in [Dashboards](/app/dashboards) before you enable enforcement.

***

## Redirect URI
OpenID Connect (OIDC) lets you connect a dashboard to any OIDC-compliant identity provider — including Okta, Microsoft Entra ID (Azure AD), Auth0, and others. When SSO is enabled, visitors are redirected to your IdP to sign in before they can view the status dashboard.

When creating the OIDC application in your identity provider, set the redirect (callback) URI to the value shown on the **Single Sign-On** tab under **Configure this value in your Identity Provider**.

> Retrieve the exact Redirect URI for your environment from the **Single Sign-On** tab on the dashboard settings page.

## Required scopes
The application must request the following scopes:

```
openid email profile
```

Your IdP must return the user's email address in the ID token or via the UserInfo endpoint.

## Client authentication method
StatusDashboard uses **`client_secret_post`** to authenticate with the token endpoint. Ensure your IdP application is configured to accept this method (as opposed to `client_secret_basic`).

## Setup guide
### Step 1 — Get the redirect URI
Open the dashboard settings, navigate to the **Single Sign-On** tab, and note the **Redirect URI** shown in the blue info card. You will need this when creating the application in your IdP.

### Step 2 — Create an OIDC application in your IdP
In your identity provider, create a new OIDC (or OAuth 2.0) application:

* **Application type** — Web application
* **Redirect URI** — the Redirect URI from Step 1
* **Scopes** — `openid`, `email`, `profile`
* **Client authentication** — `client_secret_post`

Once created, note the **Client ID**, **Client Secret**, and **Issuer URL** — you will need these in the next step.

Assign the application to the users or groups that should have access to the status dashboard.

### Step 3 — Enter your IdP details
In StatusDashboard:

1. Go to the dashboard's **Single Sign-On** tab.
2. Select **OIDC** as the provider type.
3. Fill in the fields:

| Field                      | Description                                                              |
| -------------------------- | ------------------------------------------------------------------------ |
| **Issuer URL**             | The base URL of your IdP. Must be a valid HTTPS URL. Used for discovery. |
| **Client ID**              | The client ID assigned to your application by the IdP.                   |
| **Client Secret**          | The client secret assigned to your application by the IdP.               |
| **Authorization endpoint** | The URL visitors are redirected to for sign-in.                          |
| **Token endpoint**         | The URL used to exchange the authorization code for tokens.              |
| **UserInfo endpoint**      | The URL used to retrieve profile attributes after authentication.        |
| **JWKS URI**               | The URL of the IdP's public key set, used to verify ID tokens.           |

Many IdPs publish these endpoint URLs in a discovery document at `{issuer}/.well-known/openid-configuration`. You can copy the values from there.

4. Click **Save**.

### Step 4 — Enable SSO
After saving, use the **Enable SSO** toggle to start enforcing authentication for visitors. Test by opening the dashboard URL in a private browser window — you should be redirected to your IdP.

## Updating the configuration
To update the provider (for example, when rotating the client secret), return to the **Single Sign-On** tab and re-enter the updated values. Saving overwrites the existing configuration. You must re-enter the **Client Secret** on every save — it is not displayed after the initial configuration.

## Removing OIDC SSO
To remove SSO from a dashboard, click **Remove provider** on the **Single Sign-On** tab. This immediately disables SSO enforcement and deletes the provider configuration. The dashboard becomes publicly accessible again.

## Sign-out behavior
When a visitor signs out, their active session is terminated and they are redirected to a sign-out confirmation page.

> The IdP-side session (the session your identity provider holds) is **not** automatically cleared at sign-out. This means a visitor who signs out and immediately returns to the status dashboard may be silently re-authenticated by their IdP without being prompted to enter credentials again. This is a known limitation of StatusDashboard-federated SSO for both SAML and OIDC. To fully end the IdP session, the visitor should close their browser.