Other Identity Providers (Generic OIDC)

Enterprise single sign-on with any OpenID Connect identity provider — Ping Identity, OneLogin, JumpCloud, Keycloak, Auth0, and others — with user and role management through SCIM provisioning.

Enterprise tier

SSO is part of the Automatum Enterprise plan. Contact your account manager to enable it for your organization.

Using Microsoft Entra ID, Okta, or Google Workspace?

Use the dedicated guides instead: Microsoft Entra ID SSO · Okta SSO · Google Workspace SSO.

---

Requirements for your IdP

The generic option works with any provider that meets three requirements:

1. OIDC discovery. The issuer URL must be https and serve <issuer>/.well-known/openid-configuration.
2. Stable sub claim. Automatum uses the token's sub as the permanent user identifier. It must never change for a user.
3. SCIM 2.0 provisioning that sends:
   • userName — the user's email
   • externalId — the same value as the OIDC sub claim
   • roles — one Automatum role value per user (see the table below)

Setup

The flow is the same as the Entra ID guide — only the IdP-side steps differ:

1. Create an OIDC web app in your IdP. Set the redirect URI shown on your Automatum SSO card (Settings → Integrations → Single Sign-On). Note the client ID, client secret, and issuer URL.
2. Set up roles. Give each user exactly one role value, using whatever mechanism your IdP maps into the SCIM roles attribute: Owner, Manager, Editor, DealDesk, CosellManager, or Viewer. Users with no role, or an unrecognized value, are read-only (Roles & Permissions).
3. Submit the configuration on the SSO card: select Other (OIDC) and enter the issuer URL, client ID, client secret, and your email domains. Copy the SCIM Tenant URL and SCIM token — the token is shown once.
4. Configure SCIM provisioning in your IdP with that URL and token (Bearer authentication). Enable create, update, and deactivate.
5. Test and activate. Provision your own user with the Owner role, run a test sign-in, check Test configuration, then Activate. Setup runs in draft mode until then — password sign-in keeps working and you cannot lock yourself out.

Behavior after activation

Identical to the other providers: your IdP manages users and roles through SCIM, deactivation cuts access immediately, and password sign-in is off for your organization. See the Entra ID guide for the full troubleshooting table — the same errors and fixes apply.

If your provider cannot meet the SCIM requirements above, contact support@automatum.io.