---
title: Connect an OpenID Connect provider
description: Connect Keycloak, Microsoft Entra ID, Auth0, Ping Identity or another OpenID Connect provider, set the groups claim, and map groups to Pyn roles.
sidebar:
  order: 2
area: integrations
feature: sso
appPath: /settings/integrations/available
lastVerified: 2026-10-22
version: "2026-10-16"
audience: admin
related:
  - integrations/sso
  - integrations/sso/connect-okta
  - settings/users
intercom:
  - id: "16838066"
    title: Enabling Single Sign On (Pyn 2)
    url: https://intercom.help/pyn/en/articles/16838066-enabling-single-sign-on-pyn-2
    note: replaces
---

Your identity provider speaks OpenID Connect and you want it to sign people into Pyn and decide their roles. The Single Sign-On integration takes the provider, its issuer and a client with the authorisation code flow, checks the provider's OpenID configuration, and shows the redirect URI and sign-in link you need.

## Before you start

- You are an admin or owner in Pyn, and the Single Sign-On integration is enabled for your workspace.
- Someone can create a confidential client in your provider: "The client needs the standard authorization code flow and a client secret." Required claims are `openid`, `profile` and `email`; add `groups` (Entra emits `roles`) if you want role mapping.
- You have the issuer, client ID and client secret. For Keycloak you need the **Keycloak Server URL** and **Realm**; Pyn composes the issuer from them.

![Connect single sign-on: choose the Provider, then enter the issuer, client ID, client secret and groups claim.](https://support.pynhq.com/media/integrations/sso/integrations-sso-connect.png)

## Steps

1. In Pyn, open **Settings** in the left navigation, then **Available** under **Integrations**.

2. Select the **Single Sign-On** tile. The **Connect single sign-on** dialog opens.

3. Choose the **Provider**: **Keycloak**, **Okta**, **Microsoft Entra ID**, **Auth0**, **Ping Identity** or **Single Sign-On** for anything else.

4. For Keycloak enter the **Keycloak Server URL** and **Realm**; for the others enter the **Issuer URL**.

5. Enter the **Client ID** and **Client Secret**. Set **Groups Claim** if your provider uses a name other than `groups`, and **Additional Scopes** if it needs more than `openid profile email`.

6. Copy the **Redirect URI** shown in the dialog: "Add this as a valid redirect URI on the client in your provider, then come back and connect."

7. Select **Connect**. The dialog shows "Checking those details with your provider..." and then a notice: "Single sign-on is configured. Use the sign-in link on the integration to let your people sign in with it."

8. On the panel, under **Group mappings**, enter comma-separated group names for **Owner groups**, **Admin groups**, **Power user groups** and **User groups**, starting with the owners.

> **Caution:** Once any group mapping is set, the provider decides roles on every sign-in and someone who matches no group becomes a User. Map your owners first.

## What you should see

The tile shows **Active** under **Installed** and the panel shows the **Redirect URI** and the **Sign-in link**: "Share this with your people to sign in through your provider. Opening it signs you in." If the dialog refuses, read its reason: "That address answered, but not with an OpenID configuration." means the issuer is not the base URL the provider publishes its configuration under; "Could not reach that issuer." means it is not reachable from the internet; "The issuer needs to be a full URL, starting with https://." is a format problem. **Reconnect** in the **...** menu reopens the dialog to change any of it.

## Related

- [Single sign-on](https://support.pynhq.com/integrations/sso/) for role mapping and what employees see.
- [Connect Okta](https://support.pynhq.com/integrations/sso/connect-okta/) for the dedicated Okta integration.
- [Users](https://support.pynhq.com/settings/users/) for the roles the group lists refer to.

## Related Intercom articles

- [Enabling Single Sign On (Pyn 2)](https://intercom.help/pyn/en/articles/16838066-enabling-single-sign-on-pyn-2) — replaces