> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heygarth.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# SSO with any OIDC provider
> Connect G360 to any standards-compliant OpenID Connect identity provider.
G360 speaks standard **OpenID Connect**, so it works with any compliant provider — not only the five documented individually. Use this page if your identity provider isn't listed, or if you're using a self-hosted one such as Keycloak, Auth0, or ADFS.
**Copy the callback URL from G360 first.** Go to **Settings → SSO Settings**, turn on **Enable single sign-on**, and copy the read-only **Callback URL** from the Identity Provider section.
## What G360 needs from your provider
Create an application (sometimes called a *client*, *relying party*, or *app integration*) with these settings.
| Setting | Value |
| ---------------------------------------- | -------------------------------------------------------------- |
| **Application type** | **Web application** — a confidential client, server-side |
| **Grant type** | Authorization Code |
| **Response type** | Code |
| **Token endpoint authentication method** | **Client Secret Post** |
| **Redirect / callback URI** | The callback URL copied from G360, **trailing slash included** |
| **Scopes** | `openid`, `profile`, `email` |
**Do not register G360 as a single-page application (SPA) or public client.** SPA registrations enforce PKCE and refuse a client secret. G360 exchanges the authorization code from its own server, so it needs a confidential client with a secret.
**Use Client Secret Post, not Client Secret Basic.** Every mainstream provider supports both. A provider configured Basic-only refuses the token exchange **after** a successful login, and the failure surfaces in G360 as a generic "not finished being set up" message — indistinguishable from a wrong secret.
## Required claims
G360 needs an email address to create or match an account. It reads the first of these claims that carries a valid address:
`email` → `preferred_username` → `upn` → `mail` → `emailAddress`
Names come from `given_name` and `family_name`.
**If no claim carries an address**, the sign-in is refused with *"Your identity provider did not send an email address."* Grant the `email` scope, and make sure the user's email attribute is actually populated in your directory. Without the `profile` scope, sign-in succeeds but first and last names are blank.
## Collect three values
| Value | Where to find it |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Client ID** | The application's overview or configuration page |
| **Client Secret** | Shown next to the Client ID — usually **only once, at creation** |
| **Issuer URL** | The OIDC discovery endpoint, almost always ending in `/.well-known/openid-configuration`. May be labelled *Well-known Configuration*, *Discovery Endpoint*, or *Metadata URL* |
**Paste the issuer URL into a browser and confirm it returns JSON** before entering it in G360. A wrong discovery URL surfaces much later as an opaque configuration error.
## Assign users
Most providers require users to be explicitly assigned or entitled to an application before they can sign in. An unassigned user is refused **by the provider**, before G360 is contacted — so there is nothing in G360 to explain the failure.
Check your provider's assignment, entitlement, or access-policy screen and add the users or groups who need G360.
## Next: enter the details in G360
Return to [Step 5 of the setup guide](/g360/sso-setup#step-5-enter-the-details-in-g360) to enter the three values, test the connection, and save.
***
## SCIM provisioning
G360 implements **SCIM 2.0** at `/scim/v2`, with `/Users` support for create, read, update and deactivate. If your provider can push SCIM to an arbitrary endpoint with a bearer token, it will work.
| Requirement | Detail |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Base URL** | Your G360 SCIM endpoint, shown alongside the token in G360's SCIM Provisioning section. **No trailing slash and no `/Users`** — your provider appends the resource itself |
| **Authentication** | Bearer token, generated in G360. Paste it **raw** — your provider adds the `Bearer` prefix itself |
| **`userName` mapping** | Must be the user's **email address**. This is the single most common SCIM setup mistake, and it fails silently |
| **Groups** | Not supported. Disable any group provisioning mapping, or every sync cycle fails |
| **Deactivation** | Both `PATCH active:false` and `DELETE` are handled |
See [SCIM Provisioning](/g360/sso-scim) for token generation and troubleshooting.
***
## Troubleshooting
If the error appears on **your provider's** page, the problem is on its side — check assignment, the redirect URI, and the token endpoint auth method. If you're back on the G360 login page with a message, see [Troubleshooting](/g360/sso-setup#troubleshooting).