Set up SSO with OneLogin

This page is for organization owners and admins who want members to sign in to Actagate with their OneLogin account. You create an OpenId Connect (OIDC) app in OneLogin, add a connection on the Actagate settings screen, test it, and then activate it.

Before you start, ask your operator to set SSO_SECRET_ENCRYPTION_KEY and WEB_BASE_URL (see Single sign-on basics).

1. Create the app in OneLogin

1. In the OneLogin admin console, add an app from the custom connector “OpenId Connect (OIDC)”. The app settings screen opens
2. On the Configuration tab, enter the temporary value https://<host>/api/auth/sso/callback/0 in Redirect URIs. The real URL is known after you save the connection in step 2
3. On the SSO tab, set Application Type to Web and set the Token Endpoint Authentication Method to POST or Basic
4. Under Users or Roles, give the app to the admin who will run the test and to the members who will sign in
5. Copy the Client ID, Client Secret and Issuer URL from the SSO tab. The issuer looks like https://<subdomain>.onelogin.com/oidc/2

Official documentation: OneLogin app settings, OpenID Connect

2. Add the connection in Actagate

1. Open Settings > Security (/ws/settings/security). Under Single sign-on, in “Pick a provider to add a connection”, open “OneLogin”. The connection form opens
2. Enter “Display name”, “Issuer URL”, “Client ID” and “Client secret”, then press “Add connection”. The screen shows “Connection saved.” and a new connection marked “Draft · Not tested” appears under “Connections”
3. Copy the “Callback URL to register in the IdP” shown on the connection. It looks like https://<host>/api/auth/sso/callback/<connection ID>
4. Register that URL in Redirect URIs on the Configuration tab in OneLogin and delete the temporary value. Match the displayed value exactly, including the connection ID

The connection form (Okta example). The OneLogin form has the same fields: the provider hint, "Official setup guide", "Display name", "Issuer URL", "Client ID" and "Client secret"

After you save, the client secret is never shown again. The screen only says “Secret: set”.

3. Test

1. Press “Test” on the connection. The OneLogin sign-in page opens
2. Sign in with your own OneLogin account. You return to the settings screen, which shows “Test passed. You can activate the connection.” The connection is now marked “Test passed”

The test runs the full authorization code flow with PKCE and checks the ID token signature, issuer, audience, expiry, nonce and sub. Your admin session stays as it is. The test creates no user and links no login method. If it fails, the screen shows a reason code.

4. Activate

1. Press “Activate” on the connection. The screen shows “Connection activated. It is now available on the login screen.” and the status changes to “Active”

You can press “Activate” only after a test passes. Changing the Issuer URL, client ID or client secret clears the test result and returns the connection to draft.

5. Check sign-in

1. An invited member who is not an admin opens the login screen. A button labeled “Continue with ” is shown
2. The member presses the button and signs in with OneLogin. The Actagate screen opens
3. Check that a user who is not assigned to the app in OneLogin cannot sign in

On the first sign-in, Actagate matches the email address that the IdP marks as verified (email_verified) against the invited member’s email address. Owners and admins sign in with an existing method first, then link the connection with “Add ” under Settings > Login methods.

6. Troubleshooting

• provider_rejected: check the app assignment and the URL in Redirect URIs
• token_exchange_failed: check the client ID, the client secret and the Token Endpoint method
• unsupported_client_auth: set the Token Endpoint Authentication Method to POST or Basic

Other reason codes are listed in SSO troubleshooting.