Join us on Nov 7 for GraphQL Summit Virtual

Set up SSO with an OIDC-based IdP

Configure an OIDC-based identity provider

Single sign-on (SSO) is available only for Dedicated and Enterprise plans . This feature is not available as part of a GraphOS trial.

This guide walks through configuring a generic OpenID Connect (OIDC) based identity provider (IdP) for use with Apollo SSO. If you use Microsoft Entra ID as your IdP, instead see the Entra OIDC guide .

If you're migrating your SSO configuration, see the self-service instructions .

ⓘ note
For organizations using SSO, access to GraphOS is exclusively managed through your IdP. Any invitation links created before SSO setup will be automatically revoked and you won't be able to create new invitation links once SSO is enabled. To give team members access, assign them to the GraphOS application in your IdP.

Setup

ⓘ note
Only GraphOS org admins can configure SSO. Check the Members tab in GraphOS Studio to see your role and which team members are org admins.

SSO setup has two main steps:

  1. Create a custom Apollo GraphOS application in your IdP.

  2. Send your application's OIDC metadata to Apollo.

These steps generally require administrative access to your IdP.

Step 1. Create a custom application

  1. Send a request to your Apollo contact to configure an OIDC SSO integration. Include the organization name(s) you are setting up SSO for, and the email domains you want to associate with the organization. Your Apollo contact will respond with:

    • A redirect URI

    • A link to a form where you can submit your SSO information to Apollo. You'll use this form in the last setup step.

    ⓘ note
    The redirect URI differs for each GraphOS organization. If setting up SSO for multiple organizations, repeat the following steps for each organization using different values.

  2. Create a new application in your SSO environment. While doing so, set the following values:

  3. Retrieve the following values from your SSO provider and save them in a local text file:

  • Client ID: this should be a specific Application ID

  • Client Secret: a secret value you may need to first create in your IdP

  • Issuer: the issuer value from a OpenID Connect metadata document found in your IdP

  1. If your IdP permits it, set the following user attributes:

    • sub: user.email

      • The sub attribute should uniquely identify any particular user to GraphOS. In most cases, user.email provides this unique mapping.

    • email: user.email

    • given_name: user.firstName

    • family_name: user.lastName

Step 2. Send OIDC metadata to Apollo

To complete the setup, complete the Apollo-provided link from step 1 with the appropriate information and inform your Apollo contact. They will then be able to complete your SSO setup.

Once your SSO setup is live, assign users to your new Apollo GraphOS application in your IdP. For help assigning the relevant groups and users, contact your SSO or Identity & Access Management team.

If team members could previously login before you implemented SSO, they must re-login to GraphOS Studio via SSO. Signing in creates a new user profile for them. Any personal API keys associated with their previous user profile will be lost. (Graph API keys are unaffected and remain functional.) Additionally, you must reassign any GraphOS roles associated with their previous user profile.