--- title: "Configuring SSO Login" slug: "configuring-sso-login" updated: 2026-10-07T15:18:27Z published: 2026-10-07T15:18:27Z canonical: "success.panaya.com/configuring-sso-login" --- > ## Documentation Index > Fetch the complete documentation index at: https://success.panaya.com/llms.txt > Use this file to discover all available pages before exploring further. # Configuring SSO Login Single sign-on (SSO) is a time-saving and highly secure user authentication process. SSO lets users access multiple applications with a single account and sign out instantly with one click. Panaya supports SSO. As a service provider (SP), Panaya provides single sign-on services for your domain. To get started, you need an OpenID Connect Identity Provider (IdP) to handle the sign-in process and provide your users’ credentials to Panaya. The only information Panaya requires is the user’s email. When users authenticate themselves through your IDP, the IDP handles their account details. Panaya does not store passwords. To configure your OpenID Connect SSO, you need the following - - The client ID - The client secret - The OpenID Connect endpoint URLs > [!NOTE] > This article is for our SAP, Oracle, and Salesforce users who want to log in with their organizational login credentials. > > For Salesforce users who want to log in with their Salesforce credentials, [click here](/v1/docs/how-to-configure-panaya-sso-login). > [!WARNING] > Note > > The Token URL must be accessible from outside of your organizational secured servers > > We will require an OpenID Scope Claim; please configure your IDP with the following authorized scopes: **OpenID** and **email** [OpenID's official documentation](https://openid.net/specs/openid-connect-basic-1_0.html#Scopes) contains more information about these standard scopes. > > For Azure and other OAuth integrations, verify that you 'Add additional claims' in the 'Token Configuration' menu. > > Select ID in Token type, choose 'email' and 'auth_time,’ and save both claims. > > ![](https://cdn.document360.io/f404076c-de23-4609-848e-2dfd4ef701b0/Images/Documentation/image-1686829229292.png) To allow users to seamlessly log in to Panaya using their organizational credentials, follow the instructions below: 1. Click on the **Settings button**![](https://cdn.document360.io/f404076c-de23-4609-848e-2dfd4ef701b0/Images/Documentation/image-6B996DDL.png) to open up the **Settings panel.** 2. In the Security section, select **View & Manage** Single Sign-On (OpenID Connect). ![](https://cdn.document360.io/f404076c-de23-4609-848e-2dfd4ef701b0/Images/Documentation/image-1639063928640.png) 3. **Fill in the details** and click **Save.** ![](https://cdn.document360.io/f404076c-de23-4609-848e-2dfd4ef701b0/Images/Documentation/image-1639063935876.png) > [!NOTE] > Multiple domains for SSO > > To include multiple domains for SSO, select these domains from the dropdown selection of the Email Domain field. Example: Users in other parts of the business in other countries may have different email addresses. All applicable email domains can be listed and will be included in the SSO configuration. ![email domains](https://cdn.document360.io/f404076c-de23-4609-848e-2dfd4ef701b0/Images/Documentation/Screenshot 2026-06-30 141704.png) > [!NOTE] > Note > > To determine your Authentication and Token Urls (endpoints), invoke your IDP's OpenID Connect metadata URL, also known as the openid-configuration page, and look for the authorization/token endpoints. The metadata openid-configuration page url may look something like this - > > https://idpname.my.idaptive.app/Panaya/.well-known/openid-configuration > > https://econnect.yourcompany.com/.well-known/openid-configuration Once you get the correct URLs, fill them in below, along with the Client ID and secret ID: ![](https://cdn.document360.io/f404076c-de23-4609-848e-2dfd4ef701b0/Images/Documentation/image-1722936825314.png) **Note: Azure users need to set the 'Secret Value' instead of the 'Secret ID'.** ![](https://cdn.document360.io/f404076c-de23-4609-848e-2dfd4ef701b0/Images/Documentation/image-1718274959967.png) The **Valid Until** field is optional and allows you to define the expiration date for the SSO configuration. Panaya Administrator users will receive an email notification 2 weeks before the expiry date defined here. We recommend adding an expiry date for your SSO. 4. Click on **Check Configuration**. 5. On the right-hand side of the screen, log in using your organizational credentials. This will verify that the configuration was successful. ![](https://cdn.document360.io/f404076c-de23-4609-848e-2dfd4ef701b0/Images/Documentation/image-1639063956400.png) For the **Redirect URL on your IDP,** use https://**my**.panaya.com/api/oauth/authenticate or https://**emea**.panaya.com/api/oauth/authenticate (depending on your specific Panaya site). > [!NOTE] > Useful Resources > > - [Azure](https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad) > - [Okta](https://developer.okta.com/docs/guides/implement-oauth-for-okta/create-oauth-app/) > - [Ping](https://docs.pingidentity.com/bundle/pingfederate-93/page/roj1564002966901.html) > > “Refresh Token” grant type must be enabled. 6. The following confirmation message will appear if the configuration is successful. ![](https://cdn.document360.io/f404076c-de23-4609-848e-2dfd4ef701b0/Images/Documentation/image-1639063969472.png) 1. If the verification fails, try signing in to Panaya using incognito mode or a different browser, then complete the Check Configuration step again. If the verification is successful, move on to the next step. If not, please review the SSO configuration in IDP again. 2. To roll out the configuration to all organizational users, click on **Roll Out To All Users**. ![](https://cdn.document360.io/f404076c-de23-4609-848e-2dfd4ef701b0/Images/Documentation/image-1639063983722.png) 8. To **deactivate SSO** and roll back to Panaya login, click **Deactivate SSO Configuration**. > [!NOTE] > See also > > [SSO Common Issues](/v1/docs/sso-configuration-common-issues) > [!WARNING] > Known Limitation When setting the PING IDP OAuth connection, the Tests e-sign cannot be used in Panaya. This is due to the implementation of OIDC. Multi-account users cannot use the SSO configuration.