Set up SSO: OpenID Connect and OneLogin

Prerequisites

• Admin access to DeepL
• Protocol: OpenID Connect
• Identity provider: OneLogin
• A company domain has been defined for the DeepL environment. For more information, see Get started: setting up SSO.

Set the SSO configuration in OneLogin

Add the application

1. Go to your OneLogin administration page and select Applications in the top navigation bar
2. Select Applications
3. Click Add App
4. Search for OpenID Connect and select the connector OpenId Connect (OIDC) published by OneLogin
   
5. Enter a name for the application, for example DeepL SSO
6. Upload the DeepL icon and click Save

Set the configuration

1. Select Configuration from the left-side menu

2. Enter the following under Login URL.

   https://ALIAS.sso.deepl.com

   Replace ALIAS with your chosen company SSO domain in both URLs. The ALIAS value can be found under Company SSO domain in the SSO configuration area in your DeepL account.

3. Enter the following under Redirect URI's.

   https://w.deepl.com/auth/realms/prod/broker/ALIAS/endpoint

   Replace ALIAS with your chosen company SSO domain in both URLs. The ALIAS value can be found under Company SSO domain in the SSO configuration area in your DeepL account.
   

4. Click Save

Get the metadata URL, client ID, and client secret

1. Select SSO from the left-side menu
2. Under Token Endpoint, set the Authentication Method to POST

3. Next to the Issuer URL, right-click Well-known Configuration and copy the link address. This is the OpenID Connect metadata URL. It ends in /.well-known/openid-configuration. You need it to set up SSO in your DeepL account.

   https://SUBDOMAIN.onelogin.com/oidc/2/.well-known/openid-configuration

   (SUBDOMAIN is the subdomain of your OneLogin instance.) 

4. Copy the Client ID
5. Select Show client secret, and copy the Client Secret
   
6. Click Save

Set the SSO configuration in DeepL account

1. Go to the Settings tab in your DeepL admin account.
   Under Team and Single sign-on, the SSO domain has the status Domain name approved.
2. Click Set up SSO next to Single sign-on.
   
   In the Set up SSO form, select OpenID Connect as the Authentication type and enter the following information from OneLogin.
   • OpenID Connect metadata endpoint: the metadata URL ending in /.well-known/openid-configuration
   • Client ID
   • Client Secret
3. Click Confirm

Give user access

After the SSO connection is set up, give your users access to the DeepL application in OneLogin.

1. Go to your OneLogin administration page and select Applications
2. Select the DeepL application
3. Select Access from the left-side menu
4. Select the role you created for DeepL access. If you have not created a role yet, go to Users and select Roles.
   
5. Click Save

Edit the SSO configuration in DeepL account

You can change the SSO configuration in your DeepL account at any time, also after you have activated SSO. 

1. Log in to DeepL with your DeepL admin account and go to the Settings tab. 
   Team admins cannot log in with SSO.
2. Under Team and Single sign-on, click Edit