SSO / OIDC setup reference
Technical reference for configuring Microsoft Entra ID, Salesforce Marketing Cloud, and custom OIDC providers with OmniLab.
This guide is the technical companion to the SSO configuration admin article. Use it when your IT team or identity provider administrator is setting up the application registration and gathering the details needed by OmniLab.
SSO is enabled by your Customer Success Manager
Customers do not self-configure SSO. Your Customer Success Manager will provide the exact OmniLab callback URL to register in your provider and enable the provider for your environment once you share the details below.
How OmniLab authenticates users
OmniLab uses the OAuth 2.0 Authorization Code flow with OpenID Connect (OIDC) for sign-in. The standard scopes requested are openid, email, and profile. For Salesforce Marketing Cloud, provider-specific OAuth endpoints are used instead.
The high-level flow:
- User clicks the provider button on the OmniLab sign-in page.
- OmniLab redirects to the provider's authorization endpoint.
- The provider authenticates the user and redirects back to OmniLab's callback URL.
- OmniLab exchanges the authorization code for tokens at the token endpoint.
- OmniLab reads the user's identity from the user info endpoint.
- If the user exists in OmniLab and is assigned to an organisation, sign-in completes.
Microsoft Entra ID
Application registration steps
- In the Azure portal, register a new application under App registrations.
- Under Authentication, add a Redirect URI (platform: Web) with the exact OmniLab callback URL provided by your Customer Success Manager.
- Under Certificates & secrets, create a new Client secret and note the value immediately (it is shown only once).
- From the Overview tab, note the Application (client) ID and Directory (tenant) ID.
Details to share with OmniLab
| Field | Where to find it | Notes |
|---|---|---|
| Application (client) ID | Azure portal — App registrations — Overview | Identifies your Entra app |
| Directory (tenant) ID | Azure portal — App registrations — Overview | Scopes the sign-in to your Microsoft tenant |
| Client secret value | Azure portal — Certificates & secrets (shown once) | Lets OmniLab complete the code exchange |
| Button display name | Your choice | What users see on the OmniLab sign-in page |
| Callback URL registered | Confirm only | The OmniLab URL must appear in the Redirect URIs list |
Scopes: openid, email, profile (standard OIDC; no additional permissions needed for sign-in only).
Salesforce Marketing Cloud
Connected app setup
- In Salesforce Marketing Cloud, go to Setup > Apps > API Integration and create a new connected app.
- Enable OAuth 2.0 and add the exact OmniLab callback URL as an authorized redirect URI.
- Note the Client ID and Client Secret after saving.
- Note the Authorization URL, Token URL, and User info URL for your Marketing Cloud instance.
Details to share with OmniLab
| Field | Notes |
|---|---|
| Client ID | Identifies your Marketing Cloud connected app |
| Client secret | Lets OmniLab complete the OAuth code exchange |
| Authorization URL | Starts the sign-in flow (instance-specific) |
| Token URL | Used for code-for-token exchange |
| User info URL | Used to read the authenticated user's identity |
| Callback URL registered | Confirm only |
Custom enterprise SSO provider (OIDC-compatible)
For any other OpenID Connect-compatible identity provider, gather the following:
| Field | Notes |
|---|---|
| Button display name | What users see on the OmniLab sign-in page |
| Client ID | Identifies your provider application |
| Client secret | Lets OmniLab complete the code exchange |
| Authorization URL | Provider's authorization endpoint |
| Token URL | Provider's token endpoint |
| User info URL | Provider's user info endpoint |
| Scope string | Usually openid email profile; include any provider-required extras |
| Callback URL registered | The OmniLab callback URL must be in the provider's allowed redirect list |
If your provider publishes an OIDC discovery document (.well-known/openid-configuration), share that URL with your Customer Success Manager — it simplifies endpoint configuration.
Pre-launch checklist
- The provider application is registered and the OmniLab callback URL is in the allowed redirect list.
- All secrets have been shared securely with your Customer Success Manager (not via email in plain text).
- At least one test user exists in OmniLab and is assigned to an organisation.
- The test user's email in OmniLab exactly matches the email the provider will return.
- You have confirmed which OmniLab environment (staging or production) the provider is being enabled for.