How to Set Up SSO with OIDC in DAVE

Summary

The steps

1. 1

   Choose your SSO provider

   DAVE supports five SSO/OIDC providers. Before opening any configuration screen, identify which provider your organisation uses and confirm you have the credentials or access needed to register a new OAuth application with that provider.

   The five supported providers are:

   • Googlesuitable for organisations using Google Workspace. Requires a Google Cloud project with an OAuth 2.0 client ID configured.
   • Microsoftsuitable for organisations using Microsoft Entra ID (formerly Azure Active Directory). Requires an app registration in your Entra ID tenant.
   • GitHubsuitable for engineering teams using GitHub organisations. Requires a GitHub OAuth App registered under your organisation.
   • Oktasuitable for organisations using Okta as their identity platform. Requires an OIDC application configured in your Okta tenant.
   • Custom OIDCsuitable for any identity provider that supports the OpenID Connect standard, including Auth0, Keycloak, PingIdentity, and others. Requires the provider's OIDC discovery URL or manual endpoint configuration.

   SSO is a separate feature from MFA (multi-factor authentication). DAVE supports eight MFA provider types independently of SSO. Enabling SSO does not configure MFA, and enabling MFA does not configure SSO. If your organisation requires both, each must be configured separately.

   Do this

   • Identify which of the five supported providers your organisation uses.
   • Confirm you have admin access to that identity provider's management console.
   • Gather the credentials you will need: for most providers this means a client ID and client secret from a registered OAuth application. For custom OIDC, also gather the issuer URL or discovery endpoint.
   • Note the callback URL that DAVE will require: you will need to register this in your identity provider before the connection can complete. The exact callback URL format is documented in the SSO configuration screen in DAVE.

   Example

   Your organisation uses Google Workspace. You open the Google Cloud Console, navigate to APIs and Services, then Credentials, and create a new OAuth 2.0 Client ID of type Web Application. You note the Client ID and Client Secret. You will paste these into DAVE's SSO configuration in a later step.

   Best practice

   Register a dedicated OAuth application for DAVE in your identity provider rather than reusing an application created for another service. A dedicated application gives you clean audit logs in your identity provider, makes it straightforward to rotate credentials without affecting other services, and lets you apply provider-specific access policies (such as restricting which users or groups can authenticate) to DAVE independently.

2. 2

   Navigate to the SSO configuration screen in DAVE

   SSO configuration is an Admin-only function in DAVE. You must hold the Admin role to access the SSO settings screen. If you do not have the Admin role, ask an existing Admin to assign it to your account under Admin, then User Management, then log out and back in for the role change to take effect.

   Note: the exact menu path to the SSO configuration screen is not documented in the current help documentation available to this guide. The gap is noted at the end of this guide and reported to the content team. Based on DAVE's navigation conventions, SSO configuration is expected to be located within the Admin settings area. Navigate to Admin, then Settings and look for an Authentication or SSO section. If you cannot locate it, contact DAVE support at hellodave.ai for the current path.

   Do this

   • Confirm your account holds the Admin role. Navigate to Admin, then User Management and verify your role badges include Admin.
   • Navigate to Admin, then Settings.
   • Look for an Authentication, SSO, or Identity Provider section within Settings.
   • Select the SSO provider you identified in Step 1.

   Example

   You navigate to Admin, then Settings. You locate the SSO section and see five provider options: Google, Microsoft, GitHub, Okta, and Custom OIDC. You select Google, and a configuration form appears with fields for Client ID, Client Secret, and the callback URL that you need to register in Google Cloud Console.

   Best practice

   Before making any changes to SSO configuration in a production tenant, test the configuration in a staging or development tenant first if one is available. An SSO misconfiguration that locks out all users from a production tenant requires direct admin intervention to resolve. Testing in a non-production environment first eliminates this risk.

3. 3

   Register the DAVE callback URL in your identity provider

   Every OAuth and OIDC flow requires a registered redirect URI (also called a callback URL) in the identity provider. This is the URL that your identity provider will redirect users back to after successful authentication. DAVE's callback URL must be registered in your identity provider before the SSO connection can complete: an unregistered redirect URI will cause the authentication flow to fail with an error from the identity provider.

   The exact callback URL is displayed in DAVE's SSO configuration screen for the selected provider. Copy it exactly, including the protocol, domain, and path, and paste it into the appropriate field in your identity provider's application settings.

   • Google: add the callback URL to the Authorised Redirect URIs list in your OAuth 2.0 Client ID settings in Google Cloud Console.
   • Microsoft: add the callback URL to the Redirect URIs list in your app registration in Microsoft Entra ID.
   • GitHub: add the callback URL to the Authorization callback URL field in your GitHub OAuth App settings.
   • Okta: add the callback URL to the Sign-in redirect URIs list in your OIDC application settings in Okta.
   • Custom OIDC: add the callback URL to the allowed redirect URIs in your identity provider's application configuration.

   Do this

   • In DAVE's SSO configuration screen, locate and copy the callback URL displayed for your selected provider.
   • Open your identity provider's management console in a separate browser tab.
   • Navigate to the application or OAuth client you registered in Step 1.
   • Add the DAVE callback URL to the list of allowed redirect URIs.
   • Save the change in your identity provider before returning to DAVE.

   Example

   DAVE's SSO configuration screen shows a callback URL. You copy it, switch to the Google Cloud Console tab, open your OAuth 2.0 Client ID, click Edit, paste the URL into the Authorised Redirect URIs field, and click Save. You return to DAVE to continue the configuration.

   Best practice

   Copy the callback URL directly from DAVE's configuration screen rather than constructing it manually. Even a single character difference, such as a trailing slash or a different path segment, will cause the redirect to fail. Identity providers perform an exact string match on redirect URIs: there is no fuzzy matching.

4. 4

   Enter your identity provider credentials in DAVE

   With the callback URL registered in your identity provider, return to DAVE's SSO configuration screen and enter the credentials from your identity provider application. For most providers this means a Client ID and a Client Secret. For custom OIDC, you will also need the issuer URL or OIDC discovery endpoint.

   The Client Secret is a sensitive credential. DAVE stores it encrypted using AES-256-GCM authenticated encryption in the per-tenant credential vault. Once saved, the secret is never returned through the API or displayed in the UI: it is write-only from the moment it is stored. If you need to rotate the secret, you will enter a new value, which overwrites the stored one.

   For custom OIDC providers, the issuer URL is used to fetch the provider's OIDC discovery document, which tells DAVE the locations of the authorisation endpoint, token endpoint, and JWKS endpoint automatically. If your provider does not support OIDC discovery, you may need to enter these endpoints manually: refer to your identity provider's documentation for the correct values.

   Do this

   • In DAVE's SSO configuration screen, paste your Client ID into the Client ID field.
   • Paste your Client Secret into the Client Secret field.
   • For custom OIDC: enter the issuer URL or discovery endpoint in the appropriate field.
   • Review any additional fields shown for your selected provider and complete them as required.
   • Do not save yet: proceed to Step 5 to test the connection before committing the configuration.

   Example

   You paste the Client ID and Client Secret from your Google Cloud Console OAuth client into the corresponding fields in DAVE's SSO configuration screen. The form shows a Test Connection button alongside the Save button. You will use Test Connection in the next step before saving.

   Best practice

   Treat the Client Secret with the same care as a production API key. Do not paste it into a chat message, a shared document, or an email to confirm it. Copy it directly from your identity provider's console into DAVE's configuration field in a single operation. If the secret is exposed, rotate it immediately in your identity provider and update the DAVE configuration with the new value.

5. 5

   Test the connection and save

   Before saving the SSO configuration, test the connection to confirm that DAVE can reach your identity provider and that the credentials are valid. A successful test confirms that the client ID and secret are correct, the callback URL is registered, and the identity provider's endpoints are reachable from DAVE's servers.

   If the test fails, the error message will indicate the cause. Common causes include: the callback URL not yet saved in the identity provider (allow a few seconds for propagation after saving in the identity provider console), an incorrect client secret, or an issuer URL that does not resolve to a valid OIDC discovery document for custom OIDC providers.

   Once the test succeeds, save the configuration. SSO becomes available to users in your tenant immediately after saving. Users can then choose to sign in with the configured provider on the DAVE login screen, in addition to their existing email and password credentials.

   Do this

   • Click the Test Connection button (or equivalent) in DAVE's SSO configuration screen.
   • If the test succeeds, click Save to activate SSO for your tenant.
   • If the test fails, read the error message, correct the identified issue (callback URL registration, client secret, or issuer URL), and test again before saving.
   • After saving, log out of DAVE and return to the login screen to confirm the SSO provider option appears.
   • Test a sign-in using the SSO provider with a non-Admin account to confirm the full authentication flow works end to end.

   Example

   You click Test Connection. After a moment, a green success indicator appears. You click Save. You open a private browsing window, navigate to the DAVE login screen, and see a 'Sign in with Google' button alongside the email and password form. You sign in with a team member's Google Workspace account and confirm they land on the DAVE dashboard with their correct roles applied.

   Best practice

   Test the end-to-end SSO flow with a non-Admin account before announcing the change to your team. This confirms that role assignment works correctly for SSO-authenticated users and that the login experience is as expected. An Admin account has elevated permissions that can mask configuration issues that would affect regular users.

What SSO does, and what it does not do

The five supported SSO providers

Before you start: what you need

Account provisioning and role assignment after SSO is enabled

Frequently asked questions