> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.instabase.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.instabase.com/_mcp/server. # Configuring OIDC SSO for single-tenant AI Hub > Configure OIDC-based single sign-on for single-tenant AI Hub. Enterprise Single-tenant Single-tenant AI Hub customers can use OpenID Connect (OIDC)-based authentication to manage AI Hub access. Using OIDC-based single sign-on (SSO) lets you leverage your organization's existing SSO identity provider (IdP) to automatically create new AI Hub user accounts upon initial login. Supported IdPs include: * Auth0 * Google Workspace * JumpCloud * Microsoft Entra ID * Okta * OneLogin * PingFederate ## Customer requirements Enabling SSO for your single-tenant AI Hub environment involves working closely with your support team. Your support team performs the configuration steps on the AI Hub side, but it's your responsibility to review this documentation and ensure the following customer requirements are met: * You've created an app registration in your IdP according to the [IdP configuration requirements](#idp-configuration-requirements). * You can provide the [discovery URL, client ID, and client secret](#app-registration-information-requirements) values for your app registration. ## IdP configuration requirements The SSO integration flow begins with registering your single-tenant AI Hub environment as a relying party in your IdP. Review the following requirements for your app registration. > **Note** > > The term *app registration* refers to registering your single-tenant AI Hub environment as a relying party in your IdP. The same concept is also commonly called an application. * **App registration name** -- No AI Hub-specific requirements for label or name. * **Authentication type** -- If prompted to select a client authentication type, select *client secret basic*, or similar. Client secrets are sent using the `HTTP BASIC` authentication scheme. * **Application type** -- If prompted to select an application type, select *web application*, or similar. AI Hub isn't a native app, single-page app, or server app. * **Redirect URI format** -- The redirect URI format is `https:///account/sso/oidc/callback`. For example, `https://customer.aihub.com/account/sso/oidc/callback`. > **Info** > > The redirect URI is sometimes called the callback URL. * **Scopes and claims** -- AI Hub requires the `openid`, `email`, and `profile` scopes. Additional claims are optional but can provide enhanced functionality. See the following table for a list of supported but optional claims. | **Claim** | **Description and usage** | **Notes** | | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `family_name` | Member's family name, used to populate the member's profile. | | | `given_name` | Member's given name, used to populate the member's profile. | | | Custom claim | A custom claim used to gate access to AI Hub. AI Hub uses the passed `true`/`false` value to permit the associated user to create or log in to their AI Hub account. The custom claim has no naming requirements but must pass a Boolean, where `true` permits access. | To use the custom claim feature, connect with Instabase Support to ensure your environment has the `OIDC_ALLOW_USER_CLAIM_NAME` environment variable enabled. | | `groups` | The group ID of an IdP-defined group to which the user belongs. When your environment is available, an admin can [create group mappings](/admin/group-management/#group-mapping) to manage AI Hub group membership at the IdP level. > **Note** > > If adding the member to multiple groups, use a comma-delimited list to define all groups. | Each AI Hub group can map to multiple IdP-defined group, and each IdP-defined group can be mapped to multiple AI Hub groups. Upstream changes in your IdP aren't immediately applied and instead take effect with the member's next AI Hub login. For example, if a member is removed from a group in your IdP, upon next login that change of status syncs and the member is removed from the mapped AI Hub group. | ## App registration information requirements To complete the SSO configuration on the AI Hub side, your support team requires the following information about your app registration: * **Discovery URL** -- Also called the .well-known endpoint or well known configuration endpoint, this is a lookup location for information about your app registration. * **Client ID and client secret** -- These values are used as your app registration's identifier and password. This table outlines where you can find the these values in select IdPs. > **Note** > > The accuracy of this table isn't guaranteed as external product user interfaces aren't closely monitored. | **IdP** | **Discovery URL value** | **Client ID and client secret value** | | ------------------ | -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Auth0 | `https:///.well-known/openid-configuration` | Client ID and client secret. Found under **Applications** > **Settings** > **Advanced** > **Endpoints**. | | Google Workspace | `https://accounts.google.com/.well-known/openid-configuration` | Client ID and client secret. Found under **[Credentials](https://console.cloud.google.com/apis/credentials)** > **OAuth 2.0 Client IDs** > Your application > **Additional information**. | | JumpCloud | `https://oauth.id.jumpcloud.com/.well-known/openid-configuration` | Client ID and client secret. Make note of your client ID and client secret when creating your app registration. | | Microsoft Entra ID | OpenID Connect Metadata Document. Found under **App registration** > **Overview** > **Endpoints** | Application (client) ID and client secret (value). Found under **App registration** > **Overview** (application ID) and **App registration** > **Certificates & Secrets** (client secret). | | Okta | `https:///oauth2/default/.well-known/openid-configuration` | Client ID and client secret. Found under **Applications** > **General** > **Client Credentials + General Settings**. | | OneLogin | `https:///oidc/2/.well-known/openid-configuration` | Client ID and client secret. Found under **Applications** > **OIDC** > **SSO**. | | PingFederate | `https:///.well-known/openid-configuration` | Client ID and client secret. Make note of your client ID and client secret when creating your app registration. |