Skip to main content

Configure OneLogin

Set up OneLogin as your identity provider using an OpenID Connect (OIDC) app.

Before you start, find your callback URL on the Configure SSO page: {gatewayUrl}/api/auth/callback/onelogin.

Create an OIDC app in OneLogin​

  1. In the OneLogin Admin Portal, go to Applications → Applications
  2. Select Add App, search for OpenId Connect, and select OpenId Connect (OIDC)
  3. Set a Display Name (e.g. "Willow") and select Save
  4. Open the Configuration tab and set:
    • Login Url: your Willow dashboard URL
    • Redirect URI's: {gatewayUrl}/api/auth/callback/onelogin
  5. Open the Parameters tab and confirm the app sends the standard OIDC claims — Willow reads email for the user's identity and name for their display name
  6. Open the SSO tab and:
    • Copy the Client ID and Client Secret
    • Copy the Issuer URL (https://your-subdomain.onelogin.com/oidc/2)
    • Set Token Endpoint → Authentication Method to Basic
  7. Select Save

Willow requests the openid, profile, and email scopes, and discovers the rest of the endpoints from {issuer}/.well-known/openid-configuration.

For more details, see OneLogin's guide to Connecting an OIDC enabled app.

Finish in Willow​

  1. Go to Admin → Settings → Authentication Settings
  2. Select Provider: OneLogin
  3. Enter:
    • Client ID: from the app's SSO tab
    • Client Secret: from the app's SSO tab
    • Issuer: https://your-subdomain.onelogin.com — the /oidc/2 suffix that OneLogin displays is optional, Willow accepts either form
  4. Select Save Changes

Assign users or roles​

In the OneLogin Admin Portal, open the Willow application → Access tab → select the roles that should have access. You can also assign individual users from Users → Applications.

Troubleshoot​

  • Test OIDC discovery: visit https://your-subdomain.onelogin.com/oidc/2/.well-known/openid-configuration. You should get a JSON response.
  • An invalid_client error during token exchange usually means the app's Token Endpoint → Authentication Method is set to POST instead of Basic
  • If sign-in succeeds but users have no display name, check the Parameters tab is sending the name claim
On this page