Other OIDC SSO providers

This guide explains how to configure Single Sign-On (SSO) for your Cortex instance with OpenID Connect (OIDC) providers that are not available as native integrations.

You must have the Configure OpenID Connector & SCIM permission.

Step 1: Configure your provider

In your OIDC provider, before setting up SSO with a third-party application, you will need to configure:

• An application and permissions

• The Cortex redirect URI: https://cortexapp.auth0.com/login/callback

• A client ID and client secret

See your provider's documentation for instructions.

Step 2: Configure SSO in Cortex

1. In Cortex, navigate to the OIDC settings page.

2. Configure the OIDC settings:

   • Type: Click the dropdown and type in the name of the OIDC provider. In the dropdown, click +Add.

   • Identifier: Enter your OIDC provider client ID.

   • Secret: Enter your OIDC provider client secret.

   • Issuer: Enter the auth URL from your SSO provider, e.g., https://oauth.id.jumpcloud.com/

3. Click Save.

Troubleshooting and FAQ

"No verified email found" error.

This error occurs when Cortex cannot find a valid email address in the ID token returned by your OIDC provider. To resolve:

1. Ensure the email scope is requested. Your OIDC application must include the email scope (in addition to openid and profile) so the provider includes email claims in the token.

2. Ensure the email claim is mapped. In your OIDC provider's attribute/claim mappings, verify that the email claim is included in the ID token. Some providers do not include it by default.

3. Include email_verified. Some providers omit the email_verified claim, which can cause Cortex to reject the email. Add email_verified (set to true) as a claim in your provider's token configuration.