How do I configure OIDC SSO with another identity provider?

Last updated: October 15, 2026

At a glance

  • Typical setup time: About 15 minutes

  • Who you need: An administrator for your identity provider

  • What Hadrius reads: Each user's identity provider profile at sign-in

Before you begin

Use this connector for an OpenID Connect identity provider that doesn't have its own Hadrius integration. You need administrator access to create an OIDC web application in your identity provider. The provider must publish a discovery document at <issuer URL>/.well-known/openid-configuration, with its authorization endpoint at <issuer URL>/authorize and its token endpoint at <issuer URL>/token.

In your identity provider

Create the Hadrius application

Create a new OpenID Connect web application (a confidential client with a client secret) and name it Hadrius.

  1. Allow the Authorization Code grant. If your provider supports refresh tokens, allow those too.

  2. Set the redirect URI to:
    https://app.hadrius.com/auth/sso

  3. Allow the scopes openid, email and profile. If your provider supports refresh tokens, also allow offline_access.

Assign users

Assign the people who should be able to sign in to Hadrius to the application.

Copy the connection details

Note the application's Client ID and Client secret, and your provider's issuer URL (for example https://idp.example.com/oidc).

In Hadrius

Add the credentials

On the OIDC SSO integration page in Hadrius, enter the issuer URL in Sign in url, and paste the client ID and client secret into Client id and Client secret. Click Save and verify. Hadrius checks your provider's discovery document before saving.

The client secret is sensitive. Paste it directly into Hadrius and don't share it by email or chat. To change other details later, leave the secret blank and Hadrius keeps the saved one.

Test connection confirms your provider still serves the endpoints Hadrius signs in with. Sign in once with SSO to confirm the whole flow.

Choose who signs in with SSO

Requirement status sets how strictly SSO is enforced:

  • Not required: everyone can choose SSO or their password.

  • Required for internal users: people on your Internal domains must use SSO. Everyone else can still use a password.

  • Required for all users: everyone must use SSO. Hadrius won't allow this while any existing user's email domain is missing from the list, so nobody is locked out.

The domains table lists the email domains that can sign in through your identity provider. Your firm's own email domain is always first and always Internal. To add more, paste them into Add domains, one per line or separated by commas, and set each one to Internal (your own staff) or External (for example consultants or affiliates).

Your edits appear under Unsaved changes, where you can undo any of them. Click Save there to apply them.