SSO Consumer Settings
Settings > Brand Settings > SSO Consumer Settings points your portal's login at an identity provider you already run, such as Okta, Auth0, Microsoft Entra ID, Keycloak, or your own OAuth 2 server.
This is the inbound direction. For the reverse, where your portal is the provider, see SSO Identity Settings.
What you need from your provider
Register your SpaceMedia portal as an OAuth 2 application first. Your provider will give you the values below, and will ask you for a redirect URI, which the page shows you.
| Field | What it is |
|---|---|
| OAuth 2 Client ID | The client identifier your provider issued |
| OAuth 2 Client Secret | The matching secret. Masked after saving |
| Authorize URL | The endpoint that starts the login flow |
| Token URL | The endpoint that exchanges the authorization code for tokens |
| User info URL | The endpoint that returns the signed-in user's profile |
All four URLs must be HTTPS.
Setting it up
- Register the application in your identity provider and copy the redirect URI from this page into it.
- Paste the client ID, client secret, and the three endpoint URLs into the dashboard.
- Save. The secret is masked once stored.
- Test a full login round trip with a real account before making SSO the only way in.
Scopes
Request the minimum your provider needs to return an identifiable user, typically the equivalent of openid, profile, and email. Broad scopes give your portal access to data it does not use, which is a liability without a benefit.
Test before you switch over
Test SSO with a real account in a private browser window before you rely on it. If the provider is misconfigured and it is your only login path, you lock yourself out of your own dashboard along with everyone else.
Check that a user who has never signed in before is handled correctly, not just an account that already exists.
If login fails
| Symptom | Usual cause |
|---|---|
| Provider rejects the redirect | The redirect URI registered with your provider does not exactly match the one shown here |
| Invalid client | The client secret was rotated at the provider and not updated here |
| Login succeeds, portal does not | The user info URL is wrong, or it returns a shape without a usable email |
| Works for you, fails for a colleague | Their account is not assigned to the application in your provider |
Common questions
Do users keep their password on my portal? Once SSO is in use, authentication happens at your provider. Manage credential policy there.
Can I use both consumer SSO and normal login? Test with both available before you remove any path, and never remove the fallback until SSO is proven with more than one account.
Which providers are supported? Any standard OAuth 2 provider that exposes authorize, token, and user info endpoints.
Why is this section greyed out? SSO sections are locked until the 30-day free trial is started with an authorized card. See Getting Started.
Was this page helpful?
SSO Identity Settings
Use your SpaceMedia portal as the OAuth 2 identity provider for an app you own, so your customers sign in once and carry that session into your own product.
JWT SSO (Zendesk)
Connect your SpaceMedia portal to Zendesk with JWT single sign-on so signed-in customers reach your help center without creating a second support account.