About OpenID Connect (OIDC) with Persona
Persona supports acting as an OpenID Connect (OIDC) Identity Provider (IdP) authenticator, so OneLogin can call Persona for identity verification as part of a sign-in flow.
OneLogin’s Trusted IdP (TIdP) feature, also called inbound federation, lets an admin add an external identity provider as one of the “spokes” of a OneLogin tenant, over SAML, OAuth, or OpenID Connect. A Trusted IdP can be added as an additional factor rather than a replacement for existing sign-in, which is what makes it a fit for identity verification: employees keep signing in to OneLogin however they do today, and Persona verification is layered in as a step-up check tied to that TIdP.
You’ll need to configure the Authentications product feature to obtain the client ID and client secret used below.
OneLogin Configuration Guide
Follow the steps below to configure Persona OIDC as a Trusted IdP in OneLogin.
1. Configure the Persona authentication template
In the Persona Dashboard, create an authentication template with the following settings:
- Allowed redirect URIs: your OneLogin tenant’s return URL,
https://<your-subdomain>.onelogin.com/access/idp. Find your subdomain in the tenant’s OneLogin URL. - Token endpoint authentication method: Client secret basic, unless your OneLogin configuration specifies otherwise.
- PKCE: optional, but Persona recommends enabling it whenever it is supported.
2. Add Persona as a Trusted IdP in OneLogin
In the OneLogin admin portal, navigate to:
- Authentication > Trusted IdPs
- Select New Trust.
Name the trust (for example, “Persona”), set Protocol Type to OIDC, and check Enable Trusted IDP. Under the OIDC configuration fields, fill in the values from your Persona authentication template:
- Issuer:
https://authenticate.withpersona.com/authenticate/oidc - Client ID: the Client ID from your Persona authentication template
- Client Secret: the Client Secret from your Persona authentication template
- Authentication Endpoint (sometimes labeled Authorization Endpoint):
https://authenticate.withpersona.com/authenticate/oidc/authorize - Token Endpoint:
https://authenticate.withpersona.com/authenticate/oidc/token
You can also find these values on Persona’s OIDC discovery endpoint:
https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configurationTo test using your sandbox environment, use the following instead: Openid Configuration
OneLogin’s own documentation is the source of truth for exact field names in the Trusted IdP setup screen, since these have changed between OneLogin releases.
3. Require the Trusted IdP as a sign-in factor
Under Security > Policies, edit the policy that applies to the users you want to verify, and add the Persona Trusted IdP as a required authentication factor. Assign the policy to a test group first, then expand it once you’ve confirmed the flow works.
4. Test the integration
- Sign in to OneLogin as a user covered by the policy from step 3.
- Complete the Persona identity verification when prompted.
- Confirm you are signed in to OneLogin once verification passes.
Related resources
- OneLogin integration overview
- How to configure Persona Authentications with OpenID Connect
- OneLogin: Configuring Trusted IdP (Relying Party Trust)
Plans Explained
OneLogin Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| OneLogin Integration | Not Available | Not Available | Limited | Available |