> ## Documentation Index
> Fetch the complete documentation index at: https://doc.quippy-lab.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OneLogin

> Configure OneLogin as your Quippy identity provider (OIDC or SAML 2.0).

OneLogin supports both OIDC and SAML. We recommend OIDC for new integrations.
Grab your **OIDC Redirect URL** (or **SAML ACS URL** and **SAML Entity ID**)
from the **Endpoints for your IdP** card on the Quippy admin portal before
you begin.

## 1. In OneLogin

<Tabs>
  <Tab title="OIDC (recommended)">
    1. In the OneLogin admin console, go to **Applications → Applications → Add App**.
    2. Search for **OpenID Connect (OIDC)** and select the connector.
    3. Set the display name to "Quippy" and save.
    4. On the new app's **Configuration** tab, set **Redirect URI's** to the
       **OIDC Redirect URL** from Quippy.
    5. On the **SSO** tab, copy:
       * **Client ID**
       * **Client Secret** (click "Show client secret")
       * **Issuer URL** — you'll see two issuers; use the `v2` variant,
         which looks like `https://<subdomain>.onelogin.com/oidc/2`.
    6. On the **Users** tab, assign access to the users or roles that need
       Quippy.

    <Frame>OneLogin — OIDC app → SSO tab with Issuer URL and Client ID.</Frame>
  </Tab>

  <Tab title="SAML 2.0">
    1. **Applications → Applications → Add App**, search for **SAML Custom
       Connector (Advanced)**.
    2. On the **Configuration** tab:
       * **Audience (EntityID)** — the **SAML Entity ID** from Quippy.
       * **ACS (Consumer) URL Validator** — a regex matching the
         **SAML ACS URL** from Quippy.
       * **ACS (Consumer) URL** — the **SAML ACS URL** from Quippy.
    3. On the **SSO** tab, set **SAML Signature Algorithm** to `SHA-256`.
    4. Copy the **Issuer URL**, **SAML 2.0 Endpoint (HTTP)**, and download the
       **X.509 Certificate**.
  </Tab>
</Tabs>

## 2. In Quippy

<Tabs>
  <Tab title="OIDC">
    | Quippy field      | Value from OneLogin                            |
    | ----------------- | ---------------------------------------------- |
    | **Issuer URL**    | e.g. `https://<subdomain>.onelogin.com/oidc/2` |
    | **Client ID**     | SSO tab → Client ID                            |
    | **Client Secret** | SSO tab → Client Secret                        |
  </Tab>

  <Tab title="SAML 2.0">
    | Quippy field            | Value from OneLogin                    |
    | ----------------------- | -------------------------------------- |
    | **IdP Entry Point**     | SAML 2.0 Endpoint (HTTP)               |
    | **IdP Entity ID**       | Issuer URL                             |
    | **Signing Certificate** | The downloaded X.509 certificate (PEM) |
    | **Signature Algorithm** | `SHA-256`                              |
  </Tab>
</Tabs>

## 3. Test connection

Click **Test connection** in the Quippy admin portal. OIDC returns the
discovered endpoints; SAML confirms the metadata endpoint responds.

Then enable SSO. [Keep a backup admin](/sso/setup#step-5) until your first
SSO sign-in succeeds.

## Common gotchas

<AccordionGroup>
  <Accordion title="Picked the v1 OIDC issuer">
    OneLogin exposes both `/oidc` (v1) and `/oidc/2` (v2) issuers. Use the
    **v2** issuer — it supports PKCE and the discovery doc Quippy fetches.
  </Accordion>

  <Accordion title="ACS URL Validator is too narrow">
    OneLogin's **ACS (Consumer) URL Validator** is a regex. If it's set to
    the wrong pattern, OneLogin rejects the AuthnRequest. A safe default is
    `^https://api\.quippy-lab\.com/.*` (or your custom API host).
  </Accordion>

  <Accordion title="Roles not mapped to Quippy">
    OneLogin can send **Roles** or **Groups** as SAML attributes / OIDC
    claims. Configure **Parameters** (SAML) or **Scopes** (OIDC) so Quippy
    receives the group claim you mapped under `Group → role mapping`.
  </Accordion>
</AccordionGroup>