Single Sign-On with OpenID Connect
note
This information is only relevant for Admins managing a Playground Private Exchange.
Let your people sign in with any OpenID Connect provider (for example Okta, Microsoft Entra ID, Auth0, Google Workspace or Keycloak). Compared with SAML, setup is shorter: you register Playground in your provider, then paste an issuer URL, a client ID and a client secret.
Before you start
- Make OpenID Connect available: Control Panel → General → Advanced Features → Enable OpenID Connect SSO, then save.
- Open Control Panel → Advanced → Connections. An OpenID Connect card appears. Choose Set up.
Step 1: Register Playground in your provider
Create a new web application in your identity provider and add this as its Redirect URI (shown in section 1 of the form, with a Copy button):
It must match exactly. Your provider will give you a Client ID and a Client secret.
Step 2: Enter the details in Playground
Section 2. Paste what it gives you.
tip
Paste your provider's issuer URL (or its .well-known/openid-configuration address) and choose Discover. Playground reads the endpoints and keys from it and shows what it found, so you only need to add the client ID and secret.
| Field | What it is |
|---|---|
| Issuer or discovery URL | Your provider's OpenID Connect address, for example https://login.example.com. Must start with https:// |
| Client ID | The identifier your provider gave this application. Not a secret |
| Client secret | The secret your provider generated. Stored encrypted and never shown again |
| Scopes | What Playground asks for. openid email profile is right for almost everyone and must include openid |
After Discover, a box lists the authorization, token and key endpoints found, and any warnings, for example when the provider does not offer PKCE, or reports a different issuer than the address you gave. For Microsoft, use the tenant-specific issuer (https://login.microsoftonline.com/<tenant-id>/v2.0), not the "common" address.
Step 3: Login button, accounts and turning it on
These work exactly as in the SAML guide:
- Button name and Logo (built-in or uploaded) appear on the login page: Sign in with followed by the button name.
- Create accounts automatically: on lets a person from your provider get an account on first sign-in (within your domain and license rules); off allows only people who already have an account.
- Allow sign-in with OpenID Connect shows the button. Set up and test first.
Step 4: Test
- Choose Test discovery. Playground contacts the provider and reports whether it is reachable.
- Open the sign-in link it shows in a private window, and sign in. Keep your admin session open.
- When it works, turn on Allow sign-in with OpenID Connect and Save.
Troubleshooting
The login history records the reason for failures:
| Code | What it means | What to check |
|---|---|---|
OIDC_DISCOVERY | Could not reach the provider | The issuer URL, and that it is reachable from the internet |
OIDC_SESSION | The sign-in session expired, or was started in another browser | Try again in one browser window |
SSO_NO_EMAIL | The provider did not send an email | The email scope, and that the user has an email |
SSO_NO_ACCOUNT | Signed in, but no account exists and automatic creation is off | Add the person, or turn on Create accounts automatically |
NO_WORK_EMAIL | The email does not belong to your domain | The email domain matches your Playground domain |
SSO_DISABLED | OpenID Connect is not enabled | Enable OpenID Connect SSO in Advanced Features, and Allow sign-in with OpenID Connect |
Security
- The authorization-code flow with PKCE is used, and responses are validated against your provider's published signing keys.
- The client secret is stored encrypted and is never sent back to the browser.
- Playground matches people by email, so only release verified company emails.