Articles in this section

See more

Single Sign-On with OpenID Connect

  • Updated
Follow

Overview

Starting with version 9.8.9, Etlworks includes built-in OpenID Connect (OIDC) single sign-on: Etlworks authenticates directly with your identity provider — Microsoft Entra ID, Google, Okta, or any standards-compliant OIDC provider — with no intermediary SSO broker required.

Note: SSO is an enterprise feature available on Enterprise and on-premise plans. Existing environments using the miniOrange-based integration continue to work unchanged — the built-in OIDC provider is an alternative, not a forced migration. For SAML identity providers, see Single Sign-On with SAML.

Configure SSO in Etlworks

All settings live under Settings → Single Sign-On:

  • Provider: disabled, miniorange (the existing signed-JWT integration), or oidc (authenticate directly with the identity provider). Existing environments with a configured Login URL and no selection continue to use miniOrange.
  • Login behavior: required redirects users to SSO automatically; optional shows an SSO button together with local login.
  • Provider display name: the name shown on the login button, for example Microsoft Entra ID or Okta.
  • OIDC issuer: the exact issuer identifier published by your provider.
  • Discovery URL: optional custom OpenID Provider Configuration URL. Leave empty to use the issuer's standard .well-known endpoint.
  • Client ID and Client secret: from the application you register in the provider. The secret is stored encrypted and never sent to the browser.
  • Token endpoint authentication: client_secret_basic (default) or client_secret_post.
  • Scopes: space-delimited; default openid email profile. The openid scope is always required.
  • Email claim: the claim containing the user's email (default email). Common fallbacks such as preferred_username and upn are also recognized.
  • Require email_verified: enable only when the provider supplies the standard email_verified claim. Microsoft Entra ID commonly does not.

Provisioning and account linking

  • Unknown user provisioning: Existing users only rejects identities that do not match an Etlworks user; SSO Landing creates a Viewer in the protected landing tenant; Fixed tenant creates a Viewer in the tenant selected in the Tenant setting.
  • Link existing users by email (default on): on first login, an identity from this trusted provider is linked to an existing active user with the same email. Every subsequent login matches by issuer and subject only — a changed email at the provider does not break or reassign the account.

The redirect URI

Every provider application you register needs this redirect (callback) URI, built from your Etlworks Home URL:

https://<your-etlworks-host>/rest/v1/sso/oidc/callback

Microsoft Entra ID

  1. In the Microsoft Entra admin center, open App registrations and register a new application.
  2. Add a Web platform with the redirect URI above.
  3. Create a client secret under Certificates & secrets.
  4. In Etlworks, set OIDC issuer to https://login.microsoftonline.com/<your-tenant-id>/v2.0, and enter the Application (client) ID and the secret.
  5. Leave Require email_verified disabled — Entra ID commonly does not supply that claim. If your accounts sign in with a UPN rather than a mail attribute, the preferred_username/upn fallbacks cover it.

Google

  1. In the Google Cloud console, open APIs & Services → Credentials and create an OAuth client ID of type Web application (configure the OAuth consent screen first if prompted).
  2. Add the redirect URI above to Authorized redirect URIs.
  3. In Etlworks, set OIDC issuer to https://accounts.google.com and enter the client ID and secret.

Okta

  1. In the Okta admin console, open Applications → Create App Integration and choose OIDC — OpenID Connect with the Web Application type.
  2. Add the redirect URI above as the Sign-in redirect URI and assign the integration to the users or groups who should have access.
  3. In Etlworks, set OIDC issuer to your Okta issuer — https://<your-domain>.okta.com, or the issuer of a custom authorization server if you use one — and enter the client ID and secret.

Logout

Signing out of Etlworks ends the Etlworks session and, for OIDC, also requests provider logout through the standard end-session endpoint, returning the user to the Etlworks login page. The logout experience is consistent across local login, built-in OIDC, and the miniOrange integration.

Social sign-in with Google, Microsoft, and Apple

Separately from enterprise SSO, the Etlworks login and sign-up pages can offer Sign in with Google, Microsoft, or Apple (available since 9.8.8; a provider button appears when the provider is enabled for your installation). This is personal social authentication, not tenant-wide SSO:

  • A social identity is linked to your Etlworks account by the provider's immutable subject identifier — never by email alone.
  • If the provider email matches an existing unlinked Etlworks account, you confirm the link by entering your current Etlworks password once. After that, sign-in is one click.
  • Account state, tenant state, remembered devices, and Etlworks two-factor authentication are all still enforced after the provider authenticates you.

Related articles