OIDC SSO
Cryptlex supports single sign-on in your app through OpenID Connect (OIDC). This allows your end users to authenticate using trusted identity providers such as Google, Microsoft, Okta, and others. You use OIDC SSO when implementing named user licenses, where users log in through your identity provider instead of Cryptlex credentials before activating their license.
Configuring single sign-on with OIDC
To enable OIDC SSO in your Cryptlex account, go to the Settings -> Account page in the admin portal and click the Configure OIDC SSO button.
In the configuration dialog, provide the following details from your identity provider (IdP):
-
Client ID: The unique identifier assigned to your application by the IdP.
-
Additional Client IDs: A comma-separated list of secondary client IDs, if applicable.
-
IdP Issuer URL: The issuer URL of your OIDC provider.
-
Default Role: The role assigned to newly provisioned users when no role claim is provided by the IdP.
-
Name Claim: The claim that contains the user's name.
-
Email Claim: The claim that contains the user's email address.
-
Role Claim: The claim that contains the user's role.
-
Auto-Provision Users on First Login: When enabled, the IdP must supply the name, email, and role claims configured above. These attributes are required for just-in-time (JIT) user provisioning in Cryptlex.
After completing all required fields, save the configuration to enable OIDC SSO.
Using OIDC with LexActivator
LexActivator includes built-in support for OIDC authentication, enabling your application to validate users through your configured identity provider before proceeding with license operations.
Authenticating the user
The authentication workflow remains the same as the process described in the Named User Licenses documentation, including user license retrieval and activation. The only difference is the use of the AuthenticateUserWithIdToken() function in place of the AuthenticateUser() function.