Enabling Single Sign-On

Prerequisites

Before you begin, ensure the following:

• You have admin access to your CLEAR Console organization. To gain access to the CLEAR Console, please contact [email protected].
• You have admin access to your Identity Provider (IdP).

Setting up SSO for your organization

The CLEAR Console exclusively supports the OpenID Connect (OIDC) protocol for SSO. This ensures secure, standards-based login flows and supports user identity claims such as email and name.

Required OIDC Fields:

• Client ID
• Client Secret
• Discovery URL (well-known configuration URL)**

Step-by-Step Setup

Step 1: In CLEAR Console

1. Navigate to the CLEAR Console and select User Management in the left navigation menu.
2. Go to the ‘Single Sign-On (SSO)’ tab at the top of the User Management page.
3. Select your identity provider: Entra, Okta, or Ping. For any other OIDC based providers, Select ‘Other OIDC’.
4. Enter the required OIDC fields that can be found in your respective SSO provider’s admin area:
   1. Client ID
   2. Client Secret
   3. OIDC Discovery Endpoint
5. After you’ve entered all three items above, click the ‘Get URI endpoints’.
6. If successful, the following fields will automatically populate:
   1. authorization_endpoint
   2. token_endpoint
   3. userinfo_endpoint
7. The Redirect URI will be provided on this page. Copy it for your IdP configuration.
8. Click Save

Step 2: Configure Your Identity Provider

→ Okta

1. In Okta Admin Console, go to Applications > Create App Integration
2. Choose OIDC - Web Application
3. Fill in application details
4. Add the Redirect URI from the CLEAR Console
5. Set Grant Type to Authorization Code
6. Assign users or groups to the app
7. Copy the Client ID, Client Secret, and Okta Domain for the Discovery URL: https://<your-okta-domain>/oauth2/default/.well-known/openid-configuration

→ Entra (Azure AD)

1. In Azure Portal, go to App registrations > New registration
2. Enter app name and Redirect URI (web)
3. After creation, go to Certificates & secrets to generate a new client secret
4. Copy the Application (client) ID and Directory (tenant) ID
5. Discovery URL format: https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration

→ Ping Identity

1. Log in to PingOne Admin Console
2. Go to Applications > Add Application
3. Choose OIDC Web App and provide Redirect URI
4. Configure required scopes and attributes
5. Retrieve Client ID, Client Secret, and Discovery URI. Your Discovery URI will be in this format: https://auth.pingone.com/<environment_id>/.well-known/openid-configuration

Step 3: Testing Your Configuration

After saving your IdP configuration in the CLEAR Console:

1. Click Get URI Endpoints
2. The URI Endpoints should populate below
3. Ensure claims (email, name) are correctly mapped

Troubleshooting