Skip to main content
G360 speaks standard OpenID Connect, so it works with any compliant provider — not only the six documented individually. Use this page if your identity provider isn’t listed, or if you’re using a self-hosted one such as Keycloak, Auth0, or ADFS.
Copy the callback URL from G360 first. Go to Settings → SSO Settings and copy the read-only Callback URL from the Identity Provider section.

Microsoft Entra ID

Okta

PingOne

OneLogin

Google

Amazon Cognito

​
What G360 needs from your provider

Create an application (sometimes called a client, relying party, or app integration) with these settings.
Do not register G360 as a single-page application (SPA) or public client. SPA registrations enforce PKCE and refuse a client secret. G360 exchanges the authorization code from its own server, so it needs a confidential client with a secret.
Use Client Secret Post, not Client Secret Basic. Every mainstream provider supports both. A provider configured Basic-only refuses the token exchange after a successful login, and the failure surfaces in G360 as a generic “not finished being set up” message — indistinguishable from a wrong secret.

​
Required claims

G360 needs an email address to create or match an account. It reads the first of these claims that carries a valid address: email → preferred_username → upn → mail → emailAddress Names come from given_name and family_name.
If no claim carries an address, the sign-in is refused with “Your identity provider did not send an email address.” Grant the email scope, and make sure the user’s email attribute is actually populated in your directory. Without the profile scope, sign-in succeeds but first and last names are blank.

​
Collect three values

Paste the issuer URL into a browser and confirm it returns JSON before entering it in G360. A wrong discovery URL surfaces much later as an opaque configuration error.

​
Assign users

Most providers require users to be explicitly assigned or entitled to an application before they can sign in. An unassigned user is refused by the provider, before G360 is contacted — so there is nothing in G360 to explain the failure. Check your provider’s assignment, entitlement, or access-policy screen and add the users or groups who need G360.

​
Next: enter the details in G360

Return to Step 4 of the setup guide to enter the three values, test the connection, save, and turn on single sign-on.

​
SCIM provisioning

G360 implements SCIM 2.0 at /scim/v2, with /Users support for create, read, update and deactivate. If your provider can push SCIM to an arbitrary endpoint with a bearer token, it will work. See SCIM Provisioning for token generation and troubleshooting.

​
Troubleshooting

If the error appears on your provider’s page, the problem is on its side — check assignment, the redirect URI, and the token endpoint auth method. If you’re back on the G360 login page with a message, see Troubleshooting.