--- title: "Manage OpenID providers" slug: "how-to-manage-openid-providers" updated: 2026-11-06T19:36:45Z published: 2026-11-06T19:36:45Z canonical: "docs.senhasegura.io/how-to-manage-openid-providers" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt > Use this file to discover all available pages before exploring further. # Manage OpenID providers In this document, you will find a step-by-step guide on how to add or remove OpenID providers in Segura™. ## Access path 1. In Segura™, on the navigation bar, hover over the **Products Menu** and select **Settings**. 2. In the side menu, select **Authentication > OpenID > Providers**. Attention For the OpenID Connect integration to work correctly with Segura™, it is necessary to ensure that the following scopes are enabled in the Identity Provider (IdP): - `openid` - `email` - `profile` These scopes are essential for the Segura™ platform to correctly identify and authenticate the user. In more restrictive environments, it may be necessary to request explicit approval of these scopes from the team responsible for SSO management. ## Add provider Info This field is mandatory only if the fields in **Endpoint URLs** are not filled in. The user must complete at least one of the two available fields: **OpenID endpoint configuration** or **Other endpoint URLs**. If the field **Other endpoint URLs** is not completed, it becomes essential that the user fills in the field **OpenID endpoint configuration** to ensure the correct configuration of the services. Note that each provider will require specific information. Therefore, whenever more details are needed, check the provider’s configuration. 1. On the **Providers report** page, click the **Add** button. 2. On the **Provider registration** screen: - **Type:** in the drop-down menu, select the type of OpenID provider to be used. - **Enable:** enable or disable the OpenID provider at the time of creation. - **Environment:** select the environment in which the OpenID provider will be used. - **Provider Name:** name of the provider to be registered. - **Icon (jpg or png – maximum 200kb):** upload area for your custom provider icon. - **Client ID:** enter the client ID for the connection. This ID is provided by the OpenID provider when registering a new application. - **Client secret:** enter the secret from the OpenID authentication provider. This secret is provided by the OpenID provider when registering a new application. - **Preferred username:** enter the OpenID attribute that will be used as the user identifier, such as `email`. - **Domain or public IP for URL Redirection:** enter Segura™’s domain or public IP address. It is used by the OpenID provider to redirect the user back to your application after authentication. - **Redirect URL:** enter the specific endpoint in your application to which the OpenID provider will redirect the user after authentication. - **Comments:** field for adding notes or additional observations about the configuration. 3. In the **Endpoint configuration** section: - **OpenID endpoint configuration:** enter the endpoint that configures OpenID. This is the base URL provided by the OpenID provider. This URL describes the necessary endpoints for OpenID interactions. This configuration automates the general discovery of endpoints. 4. In the **URLs of other endpoints** section: - **Authorization endpoint:** enter the URL provided by the OpenID provider, used by the application to send authorization requests. - **Token endpoint:** enter the URL provided by the OpenID provider, to which the application sends requests to exchange the authorization code for an access token. - **Userinfo endpoint:** enter the URL provided by the OpenID provider, through which the application can request authenticated user profile information using the access token. 5. In the **Extra configurations for provider** section: - **JWK endpoint (mandatory if it is not in the main openid endpoint):** enter the endpoint where the application should obtain the OpenID provider’s public keys to validate the access token signature. This field is mandatory if these keys are not available in the OpenID configuration endpoint. - **Additional Issuers (separated by commas):** enter the list of additional issuers accepted by the application. Useful when the application needs to support multiple OpenID providers. 6. Optional: configure the **Authorization configuration by device** section to let users sign in to Terminal Proxy and RDP Proxy through this provider from a second device. For how the flow works, see [Device authorization](/v4-2/docs/about-device-authorization). Segura™ requires the client ID, the client secret, and the 3 endpoints when device authorization is enabled on an active provider with the **Local** environment. If one is missing, Segura™ does not save the provider and shows a message that lists the required fields. Device authorization uses only active providers with the **Local** environment. A provider with the **Domum Remote Access** environment is never used. Device authorization uses one provider only. If more than one active Local provider has it enabled, Segura™ warns you when you save and names the provider in use. Device authorization identifies the user by comparing the value of the claim set in **Preferred username** with the Segura™ username of an active user. For Microsoft Entra ID accounts without an email address, set **Preferred username** to `preferred_username`. Then make the Segura™ username match the user principal name (UPN). Attention When device authorization is enabled and working, Terminal Proxy and RDP Proxy ask every client user to sign in through it, including local users. Database Proxy does not use device authorization. Sessions that you open from the Segura™ web portal use the web portal sign-in. If device authorization is disabled or cannot start, the proxies return to username and password sign-in with Segura™ MFA. Segura™ has validated device authorization with Microsoft Entra ID. - **Enable device authorization:** enable device authorization for this provider. - **Client ID for Device Authorization:** enter the client ID of the application registered for device authorization. Leave it empty to use the provider's **Client ID**. - **Client Secret for Device Authorization:** enter the client secret of that application. Leave it empty to use the provider's **Client secret**. - **Device Authorization Endpoint:** enter the device authorization endpoint URL of the identity provider. - **Token Endpoint URL:** enter the token endpoint URL of the identity provider. - **User information endpoint URL:** enter the user information endpoint URL of the identity provider. 7. Click **Save**. ## Update provider To update the information of a previously registered provider, follow these steps: 1. In Segura™, on the navigation bar, hover over the **Products Menu** and select **Settings**. 2. In the side menu, select **Authentication > OpenID > Providers**. 3. In the **Providers** report, find the record you want to update, click the **Actions** button, and select **Edit**. 4. Update the necessary information and click **Save**. Info If the client_secret is not changed, the current information will be retained. ## View provider details To view provider details, follow these steps: 1. In the **Providers** report, find the record you want to update, click the **Actions** button, and select **Provider details**. 2. The **Provider registration** window will open in view-only mode. 3. You can view various details of the registered provider in this window, such as: OpenID endpoint configuration, Authorization Endpoint, Userinfo Endpoint, Redirect URL, Token Endpoint, and Comments. 4. To view information individually, click the eye icon next to the text field of each detail. ## Delete a provider 1. In the **Providers** report, find the record you want to update, click the **Actions** button, and select **Deactivate**. 2. In the confirmation modal, click **Yes** to deactivate the provider.