Before you begin

To complete this guide, you’ll need:

• A ConductorOne enrollment code (if you don’t have an enrollment code, contact support@conductorone.com)
• Ability to create an SSO app in the IdP (if using Okta, OneLogin, or JumpCloud)

Estimated time: 15 minutes

Step 1: Register your ConductorOne domain

1. Go to https://accounts.conductor.one/accounts/signup.

2. In the Domain field, enter the domain you want to use for your ConductorOne instance.

   For example, if you work at Acme Co., enter acmeco to create an acmeco.conductor.one domain.

3. In the Display name field, enter the name of your company.

4. In the Invite code field, paste in the invite code you received from ConductorOne. The code is case-sensitive.

5. Click Sign up with [your SSO provider].

Step 2: Authenticate with your SSO provider

Jump to the instructions for your SSO provider:

• Google
• Okta
• OneLogin
• JumpCloud
• Microsoft

Authenticate with Google

When prompted to login, click your corporate account and continue logging in.

Google will now re-authenticate you, if needed, and log you in to ConductorOne.

Authenticate with Okta

Step 1: Add the ConductorOne app in Okta

First, add the ConductorOne app to Okta.

1. In a new browser tab, navigate to the Okta admin console and click Applications > Applications > Browse App Catalog.

2. Search for “ConductorOne” and select the ConductorOne app, then click Add Integration.

3. In the Subdomain field, enter the domain you chose for your ConductorOne instance.

4. Select whether you want to make the ConductorOne application visible to users, then click Done.

Step 2: Assign users to the Okta app

Next, assign the ConductorOne app to an Okta user or group so the user or group can access and use the app.

If you do not assign the Okta app to yourself, you will receive an error at login and your ConductorOne tenant will not be created!

1. Still in the Okta admin console, click the ConductorOne app’s Assignments tab.

2. Click Assign and select either Assign to People or Assign to Groups.

3. Locate the user or group you want to assign the app integration to and click Assign.

4. Confirm that the data is correct in the Assign ConductorOne to dialog.

5. Click Save and Go Back. The Assigned button for the user or group is disabled to indicate the app integration is assigned.

6. If necessary, repeat steps 2-6 to assign the ConductorOne app to additional users or groups.

7. Click Done.

Step 3: Input OAuth credentials into Okta ConductorOne app

In this step, you’ll configure the SSO settings for the ConductorOne app in Okta. To complete this step you’ll move back and forth between your Okta tab and the ConductorOne registration tab.

1. In Okta, click Applications > Applications > ConductorOne to return to the new ConductorOne application’s details screen.

2. Copy your Okta domain (such as acmeco.okta.com) from the browser’s address bar and paste your Okta domain into the Okta domain field in ConductorOne.

3. In Okta, click the Sign On tab. Copy the ConductorOne app’s client ID by clicking the Copy to clipboard icon.

4. In ConductorOne, paste the client ID into the Client ID field.

5. In Okta, copy the ConductorOne app’s client secret by clicking the Copy to clipboard icon, then paste the client secret into the Client secret field in ConductorOne.

6. In ConductorOne, click Sign up with Okta.

Okta will guide you through the SSO sign-in process and redirect you to the ConductorOne dashboard.

Authenticate with OneLogin

Step 1: Create the ConductorOne app in OneLogin

1. In a new browser tab, navigate to the OneLogin administration portal and click Apps.

2. Click Add App.

3. Search for “OpenID Connect” or “oidc” and click OpenId Connect (OIDC).

4. Enter the following information in the specified fields:

   • Display name: ConductorOne
   • (Optional) Logo:

     

5. Click Save.

6. On the Configuration tab, fill out the specified fields as follows:

   • Login Url: Leave this field blank
   • Redirect URI’s: Enter https://accounts.conductor.one/auth/callback
   • Post Logout Redirect URIs: Leave this field blank

7. On the SSO tab, make the following selections:

   • Application Type: Web
   • Authentication Method: POST

Step 2: Configure the SSO settings on the OneLogin ConductorOne app

In this step, you’ll configure the SSO settings for the ConductorOne app in OneLogin. To complete this step you’ll move back and forth between your OneLogin tab and the ConductorOne registration tab.

1. In OneLogin, copy your OneLogin domain (such as acmeco.onelogin.com) from the browser’s address bar.

2. In ConductorOne, paste your OneLogin domain into the OneLogin domain field.

3. In OneLogin, on the SSO tab, copy the ConductorOne app’s Client ID.

4. In ConductorOne, paste the Client ID into the Client ID field.

5. In OneLogin, copy the ConductorOne app’s Client Secret.

6. In ConductorOne, paste the Client Secret into the Client secret field.

7. In ConductorOne, click Sign up with OneLogin. OneLogin will now guide you through the SSO sign-in process and redirect you to the ConductorOne dashboard.

Step 3: Assign users to the OneLogin ConductorOne app

Lastly, give your colleagues access to ConductorOne via OneLogin SSO by adding the new ConductorOne app to a OneLogin role.

1. In the OneLogin admin portal, navigate to User Groups.

2. Select the existing user group you’d like to give access to ConductorOne (or create a new user group by clicking the Create button).

3. Click Applications and select ConductorOne.

4. Click Save.

Authenticate with JumpCloud

Step 1: Create an OIDC app in JumpCloud

1. In a new browser tab, navigate to the JumpCloud Admin Portal and click User authentication > SSO.

2. Click + Add New Application.

3. Scroll to the bottom of the window and click Custom OIDC App.

4. Enter the following information in the specified fields:

   • Display Label: ConductorOne
   • (Optional) Logo:

     

5. Click Save.

6. On the SSO tab, fill out the specified fields as follows:

   • Redirect URIs: Enter https://accounts.conductor.one/auth/callback
   • Client Authentication Type: Client Secret POST
   • Login URL: https://YOUR_DOMAIN.conductor.one/login?sso_operation=initiate_login (use the ConductorOne domain you chose in Step 1)

7. In the User Attribute Mapping section, enter email in the Service Provider Attribute Name field and select email in the JumpCloud Attribute Name field, then click Add Attribute.

8. On the User Groups tab, select one or more groups to assign access to ConductorOne.

9. Click Activate. Leave the Application Saved popup that displays the Client ID and the Client Secret fields open. You’ll use these values in the next step.

Step 2: Configure OIDC settings on the JumpCloud ConductorOne app

In this step, you’ll configure the SSO settings for the ConductorOne app in OneLogin. To complete this step you’ll move back and forth between your JumpCloud tab and the ConductorOne registration tab.

1. In JumpCloud, copy the ConductorOne app’s Client ID from the Application Saved popup.

2. In ConductorOne, paste the Client ID into the Client ID field.

3. In JumpCloud, copy the ConductorOne app’s client secret and paste it into the Client secret field in ConductorOne.

4. In ConductorOne, click Sign up with JumpCloud. JumpCloud will now guide you through the SSO sign-in process and redirect you to the ConductorOne dashboard.

Step 3: Grant users access and login

Lastly, give your colleagues access to ConductorOne via JumpCloud SSO by adding the new ConductorOne app to a JumpCloud user group.

1. In the JumpCloud Admin Portal, navigate to User Groups.

2. Select the existing user group you’d like to give access to ConductorOne (or create a new user group by clicking the Create button).

3. Click Applications and select ConductorOne.

4. Click Save.

Authenticate with Microsoft

1. When prompted to authenticate with Microsoft, select your corporate account.

2. Review the permissions requested by ConductorOne. These permissions are needed to establish the SSO link between Microsoft and ConductorOne.

   • If you have the correct permission level in Microsoft, check the box to Consent on behalf of your organization. This enables the requested ConductorOne permissions for all users in your organization.
   • If you do not have the permissions needed to check the box, before other users attempt to sign into ConductorOne using SSO, direct your Microsoft administrator to manage permissions for the ConductorOne application in by navigating to Enterprise applications > ConductorOne SSO > Permissions and clicking Grant admin consent for ….

3. Click Accept.

Microsoft will now guide you through the SSO sign-in process and redirect you to the ConductorOne dashboard.

Success!

Your ConductorOne tenant is created and you are logged in!

See our other getting started guides to move through the product and get on the fast track to modern governance.