---
title: Set up OpenId Connect SSO
slug: configured-commerce/docs/set-up-openid-connect-sso
docTags: 
createdAt: 2026-08-13T10:46:27.000Z
---

You can use OpenId Connect SSO as an identity layer on top of the OAuth 2.0 protocol. This allows you to verify user identities based on the authentication performed by an Authorization Server.

Login via OpenId Connect is enabled by changing the relevant settings in the Admin Console. Changes to these settings will not take affect until after the application pool is recycled.

## Enable OpenId Connect SSO

1. Go to **Administration > System > Settings** in the Admin Console.
2. Search for **Allow Sign in With OpenId Connect**.
3. Set the **Allow Sign in With OpenId Connect** toggle to **YES**. If Yes, an OpenId Connect button will appear on the sign in page. Default value: No.
4. Set the **Use OpenId Connect Sign In on Storefront** toggle to **YES**, if you want to enable this. If Yes, an OpenId Connect button will appear on the storefront sign in page. Default value: No.
5. Set the **Use OpenId Connect Sign In on Admin Console** to **YES**, if you want to enable this. If Yes, an OpenId Connect button will appear on the admin console sign in page. Default value: No.
6. Enter an **OpenId Connect Caption**. This is the caption to show on the OpenId Connect button. Default value: OpenIdConnect.
7. Enter your **OpenId Connect Client ID**. The client ID identified by your OpenId Connect application used for OpenId Connect login.
8. Enter your **OpenId Connect Client Secret**. The Client Secret identified by your OpenId Connect application used for OpenId Connect login. Leave this blank if it's not required.
9. Enter you **OpenId Connect Authority URL**. The Authority URL of your OpenId Connect application.
10. Set the **OpenId Connect Requires Nonce** toggle to **NO**, or false, if your OpenId Connect provider does not support nonce. Default value: Yes.
11. Click **Save**.

:::hint{type="info"}
**📘 Note**
If you plan on using SSO for the Admin Console and you do not wish to automatically assign any permissions, you should update the **Assign A/C User Role with SSO** setting to **NO**.  New Admin Console users will then require an existing user to set their roles up manually. Default value: Yes.
:::

## Configure the SSO Clients

:::hint{type="info"}
**📘 Note**
This step is not required in net8.0+.
:::

1. Go to **Administration > Permissions > Single Sign On** in the Admin Console.
2. Click **Edit** for the **ext** client to use OpenID Connect for the storefront. Enter your website URLs in the **Redirect Uris** (comma separated list of redirect URIs). These have to use the path `/identity/externalcallback`, such as `https://www.b2bcommercesite1.com/identity/externalcallback`, `https://www.b2bcommercesite2.com/identity/externalcallback`, and so on. Click **Save**.
3. Click **Edit** for the **isc\_admin\_ext** client to use OpenID Connect for the Admin Console. Enter your website URLs in the **Redirect Uris** (comma separated list of redirect URIs). These have to use the path `/identity/adminexternalcallback`, such as `https://www.b2bcommercesite1.com/identity/adminexternalcallback`, `https://www.b2bcommercesite2.com/identity/adminexternalcallback`, and so on. Click **Save**.

## Enable the Use Authorization Code Flow setting

This global setting is only available to ISC\_System and ISC\_Implementer and is hidden unless **Allow Sign in With OpenId Connect** is toggled to **Yes**.

1. Go to **Administration** > **Settings** > **Site Configurations** > **Openid Connect SSO** in the Admin Console.
2. Toggle **Use the Authorization Code Flow instead of the Hybrid Flow** to **Yes** if your OpenId Connect provider does not support the Hybrid Flow (AWS Cognito).

## Additional extension points

### Settings

There are now settings for Scopes and ResponseTypes that have default values of **openid profile email** for Scopes and **code id\_token** for ResponseTypes. You can change these values if you need to for your IDP.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/Ib1SVeAX9Y5v4SbRz03Tn_bd849e3-openidconnectextensions.png)

### Plugins

:::hint{type="info"}
**📘 Note**
These extension points are not available in net8.0+.
:::

1. Implement `IInjectOidcFactoryStartup` which passes you the `IdentityServerServiceFactory` to make any changes or additional configurations.
2. Implement `IInjectOidcSecurityTokenValidated` to inject logic into the **Security Token Validated** event.