Set up OpenID Connect (OIDC) SSO

OpenID Connect (OIDC) is the quickest way to connect Cesura to a modern identity provider such as Microsoft Entra ID (Azure AD), Okta, Google Workspace, or AD FS. This guide is for Organization Admins. If you haven't yet, read "Single Sign-On (SSO) for your organization" first.

Tip: If you don't see a Single Sign-On page, SSO isn't turned on for your organization yet. Switch on Enable Single Sign-On (SSO) in Organization Management → Preferences and save.

Step 1 — Register Cesura in your identity provider

In your IdP, create a new application (an OpenID Connect web app). Note its discovery URL (the OpenID configuration or issuer URL), and generate a Client ID and Client secret for Cesura.

Note: You'll also need a Redirect URI (callback URL). Cesura shows it after you save the connection (Step 3) — add it to your IdP app then.

Step 2 — Add the connection in Cesura

1. Open Organization Management → Single Sign-On.
2. Click Add connection.
3. Set Protocol to OIDC.

Fill in the fields:

• Display name — a label for this connection (optional).
• OIDC discovery URL — your IdP's OpenID configuration or issuer URL. Required.
• Client ID — the client or application ID your IdP issued for Cesura. Required.
• Client secret — the secret your IdP issued. Required when creating the connection; leave blank when editing later to keep the existing one.
• Scopes — the OAuth scopes to request. Default "openid email profile"; change only if your IdP needs something different.
• Email / identity claim — the ID-token claim that carries the user's email. Default "email"; set it to "upn" for AD FS or myIDF providers that don't emit a standard email claim.

Step 3 — Finish the configuration

1. Set the shared options — Default role for new users, Auto-create users on first login (JIT), and (optionally) Enforce SSO for this organization.
2. Click Add connection to save.
3. Open the saved connection again (the Edit connection pencil in its row). It now shows a Redirect URI. Copy it and add it as the exact redirect or callback URI in your IdP application.

Step 4 — Test the sign-in

Sign out (or use a private window) and sign in to Cesura with an account on your IdP. The first sign-in creates the Cesura user (when JIT is on) with the default role you chose. If sign-in fails, double-check the discovery URL, the client ID and secret, and that the Redirect URI in your IdP matches exactly.

Need a hand? Reach out through Contact support under Get help in the sidebar.