# Configure Persona as an Authentication Method in OneLogin

> Add Persona as a Trusted IdP in OneLogin using generic OpenID Connect, so sign-in policies can require identity verification.

Source: https://help.withpersona.com/articles/FCB9q3Gyp4g2s5ZJrQuLIn/
Section: Marketplace and 3rd-Party Integrations > Authentication > OneLogin

## About OpenID Connect (OIDC) with Persona

Persona supports acting as an [OpenID Connect](https://openid.net/) (OIDC) Identity Provider (IdP) authenticator, so [OneLogin](https://www.onelogin.com/) can call Persona for identity verification as part of a sign-in flow.

OneLogin's **Trusted IdP (TIdP)** feature, also called inbound federation, lets an admin add an external identity provider as one of the "spokes" of a OneLogin tenant, over SAML, OAuth, or OpenID Connect. A Trusted IdP can be added as an additional factor rather than a replacement for existing sign-in, which is what makes it a fit for identity verification: employees keep signing in to OneLogin however they do today, and Persona verification is layered in as a step-up check tied to that TIdP.

ℹ️

You'll need to configure the [Authentications product feature](https://help.withpersona.com/articles/1Acdx2QDfwgE1q3DTVPqW4/) to obtain the client ID and client secret used below.

## OneLogin Configuration Guide

Follow the steps below to configure Persona OIDC as a Trusted IdP in OneLogin.

### 1\. Configure the Persona authentication template

In the Persona Dashboard, create an [authentication template](https://app.withpersona.com/dashboard/authentication-templates) with the following settings:

- **Allowed redirect URIs**: your OneLogin tenant's return URL, `https://<your-subdomain>.onelogin.com/access/idp`. Find your subdomain in the tenant's OneLogin URL.
- **Token endpoint authentication method**: Client secret basic, unless your OneLogin configuration specifies otherwise.
- **PKCE**: optional, but Persona recommends enabling it whenever it is supported.

### 2\. Add Persona as a Trusted IdP in OneLogin

In the OneLogin admin portal, navigate to:

- **Authentication > Trusted IdPs**
- Select **New Trust**.

Name the trust (for example, "Persona"), set **Protocol Type** to **OIDC**, and check **Enable Trusted IDP**. Under the OIDC configuration fields, fill in the values from your Persona authentication template:

- **Issuer**: `https://authenticate.withpersona.com/authenticate/oidc`
- **Client ID**: the **Client ID** from your Persona authentication template
- **Client Secret**: the **Client Secret** from your Persona authentication template
- **Authentication Endpoint** (sometimes labeled Authorization Endpoint): `https://authenticate.withpersona.com/authenticate/oidc/authorize`
- **Token Endpoint**: `https://authenticate.withpersona.com/authenticate/oidc/token`

You can also find these values on Persona's OIDC discovery endpoint:

```text
https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configuration
```

To test using your sandbox environment, use the following instead: [Openid Configuration](https://authenticate.withpersona.com/authenticate/oidc-sandbox/.well-known/openid-configuration)

ℹ️

OneLogin's own documentation is the source of truth for exact field names in the Trusted IdP setup screen, since these have changed between OneLogin releases.

### 3\. Require the Trusted IdP as a sign-in factor

Under **Security > Policies**, edit the policy that applies to the users you want to verify, and add the Persona Trusted IdP as a required authentication factor. Assign the policy to a test group first, then expand it once you've confirmed the flow works.

### 4\. Test the integration

1.  Sign in to OneLogin as a user covered by the policy from step 3.
2.  Complete the Persona identity verification when prompted.
3.  Confirm you are signed in to OneLogin once verification passes.

## Related resources

- [OneLogin integration overview](https://help.withpersona.com/articles/5XUEX40WhyDPCaOAuxemMH/)
- [How to configure Persona Authentications with OpenID Connect](https://help.withpersona.com/articles/1Acdx2QDfwgE1q3DTVPqW4/)
- [OneLogin: Configuring Trusted IdP (Relying Party Trust)](https://support.onelogin.com/kb/4266545/configuring-trusted-idp-for-relying-party-trust)

## Plans Explained

### OneLogin Integration by plan

|                      | Startup Program | Essential Plan | Growth Plan | Enterprise Plan |
| -------------------- | --------------- | -------------- | ----------- | --------------- |
| OneLogin Integration | Not Available   | Not Available  | Limited     | Available       |

[Learn more about pricing and plans](https://withpersona.com/pricing?utm_source=product&utm_medium=referral&utm_audience=a&utm_campaign=cm_gen_ds_hc-plan-table).