General OIDC

  1.2. Configure **Redirect URL** to be `https://app.infisical.com/api/v1/sso/oidc/callback`. If you're self-hosting Infisical, replace the domain with your own.

  1.3. Configure the scopes needed by Infisical (email, profile, openid) and ensure that they are mapped to the ID token claims.

  1.4. Access the IdP’s OIDC discovery document (usually located at `https://<idp-domain>/.well-known/openid-configuration`). This document contains important endpoints such as authorization, token, userinfo, and keys.

  2.2. You can configure OIDC either through the Discovery URL (Recommended) or by inputting custom endpoints.

  To configure OIDC via Discovery URL, set the **Configuration Type** field to **Discovery URL** and fill out the **Discovery Document URL** field.

  <Note>
  Note that the Discovery Document URL typically takes the form: `https://<idp-domain>/.well-known/openid-configuration`.
  </Note>

  ![OIDC general discovery config](../../../../images/sso/general-oidc/discovery-oidc-form.png)

  To configure OIDC via the custom endpoints, set the **Configuration Type** field to **Custom** and input the required endpoint fields.
  ![OIDC general custom config](../../../../images/sso/general-oidc/custom-oidc-form.png)

  2.3. Select the appropriate JWT signature algorithm for your IdP. Currently, the supported options are RS256, RS512, HS256, and EdDSA.

  2.4. Optionally, you can define a whitelist of allowed email domains. Wildcard patterns such as `*.example.com` are supported to allow entire subdomain trees (e.g. `team.example.com`, `eng.example.com`).

  Finally, fill out the **Client ID** and **Client Secret** fields and press **Update** to complete the required configuration.

   </Step>

 <Step title="Enable OIDC SSO in Infisical">
  Enabling OIDC SSO allows members in your organization to log into Infisical via the configured Identity Provider

  ![OIDC general enable OIDC](../../../../images/sso/general-oidc/org-oidc-enable.png)
</Step>

<Step title="Enforce OIDC SSO in Infisical">
  Enforcing OIDC SSO ensures that members in your organization can only access Infisical
  by logging into the organization via the Identity provider.

  To enforce OIDC SSO, you're required to test out the OpenID connection by successfully authenticating at least one IdP user with Infisical.
  Once you've completed this requirement, you can toggle the **Enforce OIDC SSO** button to enforce OIDC SSO.

  <Warning>
     We recommend ensuring that your account is provisioned using the identity provider prior to enforcing OIDC SSO to prevent any unintended issues.
  </Warning>
  <Info>
     In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. https://app.infisical.com/login/admin.
  </Info>
</Step>