OIDC and OAuth 2.0
Authorization code with PKCE, refresh tokens, standard discovery and JWKS.
WhyCloud SSOGA
One sign-in, every app
Put your apps behind WhyCloud SSO: people sign in once and reach every company tool. Run the same service on your own server, entirely inside your network.
- OIDC
- Standard
- Cloud + on-prem
- One console
- 30 days
- Active-user window
SSO appsLIVE
| App | Type | Status |
|---|---|---|
| Grafana | Web | Active |
| GitLab | Web | Active |
| Mobile app | PKCE | Active |
| CI bot | Machine | Limited |
Live
HOW IT WORKS
How it works
- 1
Enable
In the console → Identity → SSO follow the setup wizard, or create an on-premise server.
- 2
Add an app
Give the app type and redirect; a client ID and secret are created.
- 3
Users
Create users, assign groups or connect Google/Microsoft sign-in.
- 4
Connect the app
Enter the issuer and client ID in the app; single sign-on is ready.
Capabilities
WhyCloud SSO
User directory
Users, groups, disabling and password resets in the console.
Google and Microsoft sign-in
Federate any OIDC identity provider, with email-domain restrictions.
On-premise
A dedicated SSO server with its own database on your server, managed from the same console.
Secure by default
Per-tenant signing keys, short-lived tokens and sign-in events.
Sign-in audit
Successful and failed sign-ins with app and IP.
Sync with AD, LDAP and Keycloak
Users and groups are imported and kept current; passwords are checked at the directory.
Two-step sign-in for everyone
Authenticator app with a QR code or an SMS code, for manual, synced and Google/Microsoft users.
USE CASES
Use cases
Employee sign-in
One account for mail, Grafana, wiki and internal tools.
Data residency
An SSO server in your own data center.
Customer apps
Standard OIDC sign-in for your app’s users.
Technical specs
- Protocol
- OpenID Connect · OAuth 2.0 · PKCE
- Signing
- RS256, per-tenant keys
- External IdP
- Google · Microsoft · any OIDC
- Directory sync
- Active Directory · LDAP · Keycloak
- Two-step
- TOTP with QR · SMS code
- Deployment
- Cloud or dedicated Docker server
- Billing
- Active user-hour · server-hour
DIRECTORY SYNC
Your existing people, no re-creation
Connect Active Directory, OpenLDAP, FreeIPA or Keycloak once. A test run shows sample users before saving; on schedule, new people are added, changes applied and removed or disabled accounts are disabled here too.
- LDAPS, StartTLS and paging
- Groups from memberOf or groupOfNames
- Protection against an empty source
CLOUD OR ON-PREM
Start in the cloud, move to your server
Cloud SSO is ready in seconds. When identity data must stay inside, install an “SSO server” on a connected machine; the console is the same and a switcher moves between deployments.
- One-click install wizard
- Automatic backup and restore
- Version upgrades with automatic rollback
APPS
Add an app, get a client ID
Choose the app type (web, SPA, mobile or machine), redirect URIs and allowed groups. Connection guides for Grafana, GitLab, Nextcloud and your own apps are on the app page.
- Client secret shown once
- Group-based access
- Built into Managed Grafana and Mail
FAQ
Frequently asked questions
Do WhyCloud console members cost anything in SSO?
No. Only SSO directory users who signed in during the last 30 days are billed, hourly.
Can users sign in with Google Workspace or Microsoft Entra?
Yes. Add any OIDC provider; users are linked by verified email or created automatically.
Does the on-premise server need the internet?
Only the agent’s outbound connection for management; user sign-ins happen entirely on your server.
Is SSO the same as console IAM?
No. IAM decides what organization members can do in WhyCloud; SSO signs users into your apps. Both live under Identity in the console.
Related services
Security & complianceLayered security with whycloud: Trivy CVE scanning, agent access contr…DevOps as a ServiceManaged registry, tunnels, logs and metrics with a self-service consol…Log ExplorerCollect, search and retain logs from all servers and services in one c…Monitoring & metricsLocal Prometheus and Thanos with live charts in the whycloud console; …
Turn on your own cloud today
Create an account and connect your first server in under five minutes.