Skip to main content
anny supports company logins via OpenID Connect (OIDC). Any identity provider that offers OpenID Connect Discovery works, for example Entra ID, Okta, Keycloak, Auth0, or Authentik. You provide the address of your identity provider and the credentials of the application. anny reads all other endpoints automatically, even if your identity provider changes them later.
If your identity provider supports SAML 2.0, we recommend that path, as more features such as SCIM and federated logins are available. You find a guide under Generic SAML 2.0 SSO.

​
Setup in Admin 3.0

In Admin 3.0 you create the connection yourself, under Account > Settings > SSO & Security. Besides anny admin rights you need administrative access to your identity provider.
Admin v2.0 does not have the OpenID Connect card. Write to us at support@anny.co and we create the connection for you.
First create a confidential application in your identity provider, sometimes also called “client” or “app”. You need the issuer URL, the client ID, and the client secret.
1

Choose OpenID Connect

Open the SSO settings. If an identity provider is already connected, click Add IDP first. Choose the OpenID Connect card.
2

Enter the credentials

Enter Issuer URL, Client ID, Client Secret, and Scopes. openid profile email is the usual value. Click Connect.
3

Store the URLs at your identity provider

After connecting, anny shows the Redirect / Callback URL. Copy it and add it as an allowed redirect URL. If a Post-logout URL is shown next to it, add that too when users should also be signed out of the identity provider when they log out.
4

Activate and test

Then activate the provider and test the login via Test Login & Connect User.
As long as the callback URL is not stored in your identity provider, the login fails with an error such as “redirect_uri mismatch”.

​
Required fields

​
Advanced options

You only need the advanced options when your identity provider differs from the standard.

​
Requirements for your identity provider

anny requests the scopes openid profile email and expects these claims:

SSO overview

Which login methods anny supports and when each one fits.

Attribute mapping

Automatically assign users to communities based on what your identity provider sends.