Skip to main content
In this article, you learn how to set up a company login via OAuth2 or OpenID Connect in anny. This is the right choice if your identity provider does not support SAML or you prefer OAuth2.
If your identity provider supports SAML 2.0, we recommend that path, as more features such as SCIM and federated logins are available. You find a guide under Generic SAML 2.0 SSO.

​
Preparation

You can set up the SSO connection yourself in your anny admin area under SSO & Security. Besides anny admin rights, you need administrative access to your identity provider to create an OAuth2 application there. First, create a new OAuth2 application (sometimes also called “client” or “app”) in your identity provider. In doing so, you receive a client ID and a client secret.

​
Setup

1

Create the identity provider in anny

Go to the SSO settings, select “Add IDP” and then choose “Custom OAuth2” as the provider. Enter a name, for example “Company login”.
2

Enter credentials and URLs

Enter the client ID, client secret, and the three endpoints of your identity provider. The table below explains which values are meant. Then save.
3

Add the callback URL to your identity provider

After saving, anny shows you the callback URL. Copy it and enter it in your identity provider as an allowed redirect URL.
4

Test the connection and activate it

Activate the identity provider via the three dots > Activate and test the login via “Test Connection”.
Important: The callback URL is only available after the first save, since it contains the ID of the identity provider. As long as the URL is not stored in your identity provider, the login fails with an error such as “redirect_uri mismatch”.
The callback URL follows this pattern, where {id} is the ID of the identity provider you created: Callback URL: https://auth.anny.co/identity-provider/{id}/oauth/callback

​
Required fields

Many identity providers publish their endpoints under https://<your-provider>/.well-known/openid-configuration. There you find the values for authorization URL, token URL, and user info URL bundled together.

​
Advanced options

You only need the advanced options if your identity provider deviates from the standard. You find them in the form under “Advanced options”.

​
Mapping attributes

By default, anny expects the fields id, email, firstname, and lastname. Many identity providers use different names. With OpenID Connect, the following values are common, for example: If the values are nested in the response, you can specify the path with dots, for example data.user.id.
These fields only control where anny reads the user data from. If you additionally want to assign users to communities automatically, use attribute mapping for that.

​
After the setup

  • Via the three dots, you can generate a wayfless link. With it, your users land directly in the login of your identity provider.
  • With attribute mapping, you automatically assign users to communities.

​
Troubleshooting

The identity provider is not activated yet. Activate it via the three dots > Activate. As long as it is deactivated, login and callback are intentionally not reachable.
The callback URL is not stored in your identity provider, or not exactly. Copy it from anny again and make sure it matches character for character, including https:// and without a trailing slash.
Check the attribute fields in the advanced options. If your identity provider returns given_name instead of firstname, for example, the value has to be entered there accordingly. Also check whether the requested scopes are sufficient to receive email and names.
Check the client ID and client secret as well as the token URL. If your identity provider requires HTTP Basic authentication or a JSON body, enable the matching advanced options.
You find a general overview of SSO here: SSO Overview