Skip to content
Tessera Tessera Docs

OIDC single sign-on

Availability Pro · Ultimate · Enterprise.

Tessera supports OIDC single sign-on with any compliant provider (Keycloak, Okta, Azure AD, Google, and others). Configure providers under Settings → Authentication.

Add a provider

Section titled “Add a provider”

For each provider set: an identifier, a display name (shown on the sign-in button), the issuer URL, client ID and secret, and scopes. The button reads “Sign in with <display name>”.

Register this redirect URI in your provider:

https://<your-controller>/oidc/callback/<identifier>

A provider is registered even if its issuer is unreachable at controller startup — the button still appears and discovery is retried on first use, so startup order doesn’t matter.

Example

Section titled “Example”
{
  "name": "okta",
  "display_name": "Acme SSO",
  "issuer": "https://acme.okta.com",
  "client_id": "tessera-controller",
  "client_secret": "…",
  "scopes": ["openid", "profile", "email"]
}

For Azure AD, use the tenant issuer (https://login.microsoftonline.com/<tenant>/v2.0).

Tessera does not map IdP groups to roles. After a user first signs in through OIDC, grant their access directly in Tessera.

OIDC and SCIM

Section titled “OIDC and SCIM”

OIDC handles how users sign in. It can block a removed user at their next login, but it can’t proactively kill an active session or pre-deactivate an account. For immediate deprovisioning, pair it with SCIM.

Cookies