---
title: 'Identity providers'
section: features
updated: '2026-06-17'
summary: 'Connect a PBX to an external authentication service so users can log in with their corporate credentials via Single Sign-On.'
---

> An **identity provider** lets you configure a generic OpenID Connect (OIDC) authentication service (such as Active Directory Federation Services (ADFS), Okta, or Keycloak) for a PBX, so your users can sign in to Cockpit with their existing corporate account through Single Sign-On. For Microsoft Entra ID, use the dedicated **Microsoft** SSO type instead of configuring an identity provider here.

## Overview

Identity providers use OpenID Connect (OIDC) to delegate authentication to services such as Active Directory Federation Services (ADFS), Okta, or Keycloak. Once configured, users on the associated PBX can authenticate through their existing organization account instead of a separate password. Each PBX has a single identity provider. (Microsoft Entra ID has its own dedicated Microsoft SSO type, so it does not need an identity provider configured here.)

## What it does

Cockpit acts as an OIDC relying party. When a user chooses SSO login, Cockpit redirects them to the provider's authorization endpoint, exchanges the resulting code for tokens, and retrieves the user profile from the userinfo endpoint. Pasting the **discovery URL** auto-fills these endpoints from the provider's well-known configuration document, so you rarely need to enter them by hand.

## See also

- [PBX instances](pbxes.md) - each identity provider is scoped to a single PBX.

```yaml fields
name:
  label: Name
  tab: 'IDP configuration'
  hint: 'Descriptive label for this provider, shown in lists and on the login screen.'
description:
  label: Comment
  tab: 'IDP configuration'
  hint: 'Internal notes for your own reference. Not shown to users.'
client_id:
  label: 'Client ID'
  tab: 'IDP configuration'
  hint: 'The OAuth 2.0 client ID issued by your identity provider.'
client_secret:
  label: 'Client secret'
  tab: 'IDP configuration'
  hint: 'The OAuth 2.0 client secret. Stored securely and not displayed after saving.'
discover_url:
  label: 'Discovery URL'
  tab: 'IDP configuration'
  hint: 'The OIDC well-known discovery endpoint. If set, the authorization and token endpoints are discovered automatically from it. If you do not have a discovery endpoint, leave this empty and set the authorization and token URLs manually. Provide either this or the authorization and token URLs.'
authorization_url:
  label: 'Authorization URL'
  tab: 'IDP configuration'
  hint: 'The OAuth 2.0 authorization endpoint. Required only when no discovery URL is set.'
token_url:
  label: 'Token URL'
  tab: 'IDP configuration'
  hint: 'The OAuth 2.0 token endpoint. Required only when no discovery URL is set.'
userinfo_url:
  label: 'Userinfo URL'
  tab: 'IDP configuration'
  hint: 'The OIDC userinfo endpoint for retrieving user profile data. Optional; if empty, user information is read from the ID token.'
issuer:
  label: Issuer
  tab: 'IDP configuration'
  hint: 'Expected token issuer value used to validate tokens. Optional; resolved from the discovery URL when available.'
```