Configure AWS Accounts (with Cloud Formation)

Configure Azure Subscriptions

Single Sign-on (SSO)

OpenGovernance supports a variety of Identity Providers to authenticate users.

To setup SSO, go to Administration -> SSO.

You will need ClientID, ClientSecret and Issuer.

If you need help generating this, we've included

AzureAD (EntraID)

Pre-requisites

• Azure account, with an existing Azure Active Directory

• You'll need permissions to create an App Registration within your Azure AD

Step 1- Setup in Azure Active Directory

1. Log in to your Microsoft Azure portal and go to Azure Active Directory.

2. Click Properties and save your Tenant ID for later.

3. Under Manage, select App registrations.

4. Click New Registration

5. On the Register an application page, give the application a name. (OpenGovernance)

6. Set Supported account types to Accounts in this organizational directory only (Default Directory only - Single tenant).

7. Click Register.

8. Copy the Application (client) ID and save for later.

   

9. Click Add a Redirect URI.

10. Under Platform configurations, click Add a platform.

11. Select Web.

12. The Redirect URI is https://<call-back>/sso/oidc/callback.

13. Click Configure.

14. Under Manage, select Certificates & secrets.

15. Click New client secret.

16. Give the secret a name and set the expiration date to your company's policy.

17. Create client credentials and Add Redirect URL. Select Add a secret.

18. Copy the Value.

19. In the automation page, there is a oidc.yaml filter. Replace vales withpage to enter the copied Client ID, Client Secret, Redirect URI and Issuer URL values.

20. Enter https://login.microsoftonline.com/<YOUR_TENANT_ID>/v2.0 as the Issuer URL, substituting your Tenant ID for <YOUR_TENANT_ID>, to finish the configuration.

Google Workspaces

Requirements​

To configure Google OIDC SSO, you must:

• Have admin permissions on Retool Cloud or permissions to add environment variables on self-hosted Retool instances.

• Have permissions to create a Google OAuth Client.

Procedure

1. Google Cloud Console.

2. Create a new Google Cloud Platform (GCP) project. If you don't have a GCP project already, please see the Google documentation topic creating and managing projects.

3. After you have created the project, open the Credentials page in the Google API Console.

4. Click "Configure Consent Screen"...

   

   ...choose "Internal" and click "Create"...

   

   ...fill in the "App name" you want to use, the "User support email" and the "Developer contact information" at the bottom (you can leave the other fields as is). Click "Save and Continue".

   

   In the next step, click "Add or remove scopes" and choose ".../auth/userinfo.email". Click "Save and continue" and then "Back to dashboard".

   
5. Go back to "Credentials" and create new OpenID credentials with Create Credentials/OAuth client ID.

   
6. Choose "Web application" as the "Application type", choose a name and add the "Reply URL" from Learnster's OIDC settings.

   
7. In the next step, copy the "Client ID" and "Client Secret" and paste them into Learnster's OIDC configuration.

Auth0 (Okta)