Prerequisites
- A OneLogin account with admin access
- Access to create applications in OneLogin Admin Portal
- Access to the Char dashboard
Quick Links
OneLogin Admin Portal
Sign in to OneLogin Administration
OIDC Documentation
OpenID Connect developer guide
API Credentials
API credentials documentation
OneLogin SDK
OneLogin SDK reference
SDK References
Configuration Steps
1
Create an OIDC Application in OneLogin
- Sign in to the OneLogin Admin Portal
- Navigate to Applications → Applications
- Click Add App
- Search for “OpenID Connect” or “OIDC”
- Select OpenId Connect (OIDC) from the results
- Click Save
2
Configure Application Settings
On the Configuration tab:
Click Save.
| Setting | Value |
|---|---|
| Login URL | Your application’s login page URL |
| Redirect URI’s | Your callback URLs (e.g., https://yourapp.com/callback) |
| Post Logout Redirect URI | Your logout redirect URL |
| Token Endpoint | Web |
| Application Type | Single Page App (SPA) |
3
Configure SSO Settings
On the SSO tab:
- Note your Client ID
- Set Token Endpoint Authentication Method to None (for SPA)
- Under Token, ensure ID Token is enabled
- Click Save

Find your Client ID and configure SSO settings
4
Note Your Subdomain and Client ID
From OneLogin:
- Subdomain: Your OneLogin subdomain (e.g.,
acmefromacme.onelogin.com) - Client ID: Found on the SSO tab of your application
- Region: Note if you’re using US (
us) or EU (eu) region
- US:
https://{subdomain}.onelogin.com/oidc/2 - EU:
https://{subdomain}.eu.onelogin.com/oidc/2
5
Configure Char
In the Char Dashboard:
- Navigate to Settings → Integration
- Under SSO Configuration, select Custom OIDC as the provider
- Enter your configuration:
| Field | Value |
|---|---|
| Client ID | Your OneLogin Client ID |
| Issuer URL | https://{subdomain}.onelogin.com/oidc/2 |
- Click Test Connection to verify
- Click Save Changes
Configuration Reference
| Char Field | OneLogin Value | Example |
|---|---|---|
| Provider Type | Custom OIDC | custom_oidc |
| Client ID | Application Client ID | a1b2c3d4-e5f6-7890-abcd-ef1234567890 |
| Issuer URL | OIDC issuer | https://acme.onelogin.com/oidc/2 |
OneLogin uses
/oidc/2 in the issuer URL path. This is the OIDC 2.0 endpoint. Don’t omit this suffix.Token Requirements
Char validates OneLogin tokens with these requirements:| Claim | Requirement |
|---|---|
iss | Must match https://{subdomain}.onelogin.com/oidc/2 |
aud | Must include your configured Client ID |
sub | Required - OneLogin user ID |
exp | Must not be expired |
Standard OneLogin ID Token Claims
| Claim | Description |
|---|---|
sub | OneLogin user ID |
email | User’s email address |
preferred_username | User’s username |
name | User’s full name |
given_name | First name |
family_name | Last name |
groups | User’s group memberships (if configured) |
params | Custom parameters (if configured) |
Example: Obtaining and Passing the Token
- OIDC Client (oidc-client-ts)
- React (react-oidc-context)
- Implicit Flow (Legacy)
Including Groups in Token
To include group memberships in the ID token:- In OneLogin Admin, go to your OIDC application
- Navigate to Parameters tab
- Click Add Parameter
- Configure:
| Setting | Value |
|---|---|
| Field name | groups |
| Include in SAML assertion | Unchecked |
| Include in OpenID Connect assertion | Checked |
| Value | User Roles (or Groups) |
- Click Save
Custom Parameters
Add custom claims to your tokens:- Navigate to your application’s Parameters tab
- Click Add Parameter
- Configure:
| Setting | Value |
|---|---|
| Field name | Your custom claim name |
| Include in OpenID Connect assertion | Checked |
| Value | Select source (User attribute, Macro, etc.) |
- Click Save
OneLogin Regions
OneLogin has multiple regional deployments:| Region | Admin URL | Issuer URL |
|---|---|---|
| US | admin.us.onelogin.com | https://{subdomain}.onelogin.com/oidc/2 |
| EU | admin.eu.onelogin.com | https://{subdomain}.eu.onelogin.com/oidc/2 |
Troubleshooting
INVALID_ISSUER error
INVALID_ISSUER error
The issuer URL doesn’t match:
- Include
/oidc/2suffix: The issuer URL must include/oidc/2 - Check region: EU customers must use
{subdomain}.eu.onelogin.com - Verify subdomain: Ensure the subdomain matches exactly
- No trailing slash: The URL should not end with
/
INVALID_AUDIENCE error
INVALID_AUDIENCE error
The token’s audience doesn’t match:
- Verify the Client ID matches exactly (including hyphens)
- Check that you’re using the ID token, not the access token
- Ensure the application type is set correctly (SPA for public clients)
JWKS_FETCH_FAILED error
JWKS_FETCH_FAILED error
Char couldn’t reach OneLogin’s JWKS endpoint:
- JWKS endpoint:
https://{subdomain}.onelogin.com/oidc/2/certs - Verify your subdomain is correct
- Check regional endpoint if applicable
- Use Test Connection in the dashboard
Groups claim missing
Groups claim missing
If groups aren’t in the token:
- Verify the
groupsparameter is configured on the application - Ensure Include in OpenID Connect assertion is checked
- Request the
groupsscope in your authentication request
User not assigned to application
User not assigned to application
If users can’t authenticate:
- In OneLogin Admin, go to Users → select user → Applications
- Ensure the user is assigned to the OIDC application
- Or configure the application with Self Service enabled
Directory Integration
OneLogin can sync users from various directories:- Active Directory: Via OneLogin AD Connector
- LDAP: Direct LDAP integration
- Google Workspace: Via API integration
- Workday: HR-driven provisioning
Security Best Practices
- Enable MFA in OneLogin policies
- Configure session timeout appropriately for your security requirements
- Use role-based access to control which users can access your application
- Enable Smart Hooks for additional authentication logic
- Monitor sign-in events in OneLogin Events
- Review application access regularly
- Configure IP restrictions if needed for your organization
- Enable Account Recovery securely

