Skip to main content

Other provider (SAML or OIDC)

ReFresh works with any identity provider that supports OpenID Connect (OIDC) or SAML 2.0, including Ping Identity, OneLogin, Auth0, Keycloak, and AD FS. In the wizard, choose Other Provider, then pick your protocol.

Written by Taylor Laing

Choose OIDC if your provider supports it: OIDC is simpler and more secure. Pick SAML only if your provider can't do OIDC.

Before you start:

  • Your domain is claimed and verified; see Setting up and managing SSO (Step 1: Claim and verify your domain).

  • You're an admin in your identity provider.

In the wizard, select Other Provider, then choose OpenID Connect or SAML.

OIDC setup

1. Get your values from ReFresh

On the Add ReFresh to your IdP step, copy:

  • Redirect URI: https://auth.refresh.tech/oauth2/callback

  • Scopes: openid, profile, email

  • Required claims: email, given_name, family_name, groups

2. Create an OIDC app in your provider

Create a new web / confidential OIDC application and set its redirect URI (a.k.a. sign-in redirect / callback URL) to the ReFresh Redirect URI. Note the generated Client ID and Client Secret, and make sure the app issues the required claims, including a groups claim if you'll map roles from groups.

3. Paste the details back into ReFresh

On the Paste IdP details step:

  • Discovery URL: your provider's OpenID configuration document, usually https://your-idp.example.com/.well-known/openid-configuration. ReFresh reads all the endpoints from it.

  • Client ID

  • Client Secret

The "Paste IdP details" step for generic OIDC, showing the Discovery URL, Client ID, and Client Secret fields.

SAML setup

1. Get your values from ReFresh

On the Add ReFresh to your IdP step, ReFresh shows the service-provider (SP) values:

  • SP Entity ID: https://auth.refresh.tech/samlv2/sp/<connection-id>

  • Assertion Consumer Service (ACS) URL: https://auth.refresh.tech/samlv2/acs

  • NameID format: email address

  • Download SP Metadata XML: upload this to your provider instead of typing values

  • Required attributes: email, given_name, family_name, groups

2. Create a SAML app in your provider

Create a new SAML 2.0 application. Enter the ACS URL and SP Entity ID from ReFresh (or upload the SP metadata file), and set the NameID to the user's email address. Add attribute statements for email, given_name, family_name, and groups.

3. Give ReFresh your IdP details

On the Paste IdP details step:

  • Metadata URL (preferred: lets ReFresh detect certificate rotations automatically), or

  • Paste / Upload Metadata XML: your provider's IdP metadata (must contain an EntityDescriptor; max 256 KB).

The "Paste IdP details" step for generic SAML, showing the Metadata URL field and the upload/paste XML option.

Advanced options

Both protocols expose optional settings on the details step:

  • Groups claim / attribute: the claim ReFresh reads group membership from (default groups). Set this if your provider uses a different name (e.g. memberOf).

  • Session lifetime (hours): how long before users must sign in again (1–24, default 8).

Roles

Set roles on the Mappings step: a default role, automatic role slugs, or manual group mappings. See Setting up and managing SSO (Roles for SSO users).

Map on group IDs, not display names: Where possible, map on the group's ID/GUID. If your provider only sends group names as a single string, ReFresh splits them on comma, semicolon, pipe, or newline, but not spaces (group names often contain spaces). Configure your provider to send groups as a list or use one of those delimiters. See Troubleshooting SSO and login.

Then test and activate per the hub.

Related Articles
Did this answer your question?