With Single Sign-On (SSO), your employees can log in to talentsconnect Home using their existing company credentials – without a separate password. This article explains what you need for setup and how the process works.
✔️ Simple Login Use existing company credentials
⚙️ Central Management Manage users via your Identity Provider
★ Secure Access Role-based access control
Prerequisite
The SSO integration at talentsconnect is based on the OpenID Connect (OIDC) protocol. A SAML-based integration is not currently supported. Please make sure your Identity Provider supports OpenID Connect before you begin the setup.
⚠️ Important: SSO is only possible with OpenID Connect (OIDC) – not with SAML.
What is needed for setup?
For the SSO integration, talentsconnect requires the following information from you:
1. Discovery Endpoint
The Discovery Endpoint is a URL that talentsconnect uses to automatically resolve the technical details of your Identity Provider. The following endpoints are determined via this URL:
- Authorization Endpoint – The URL to which users are redirected for login.
- Token Endpoint – The URL via which the access token is issued after login.
ℹ️ Note: The Discovery Endpoint typically has the following format:
https://[your-identity-provider]/.well-known/openid-configuration
2. Client ID & Client Secret
You will need to create an OAuth client (also called an "app" or "application") in your Identity Provider and share the following details with us:
- Client ID – The unique identifier of the client.
- Client Secret – The corresponding secret used for authentication.
ℹ️ Tip: We will share the Redirect URI that you need to enter when creating the client during our joint setup session.
3. Role Mapping
talentsconnect uses a role-based permission system. You let us know how your internal roles should be mapped to our roles:
| talentsconnect Role | Description |
|---|
| Admin | Full access to all areas of talentsconnect Home |
| Data Analyst | Access to data & analytics, without configuration permissions |
| GoHiring User | Only relevant if you use GoHiring |
You also let us know which claim in your Identity Provider the roles are transmitted in (e.g. roles, groups, or a custom claim).
ℹ️ Note: If you are unsure which claims your Identity Provider sends, your IT team or Identity Provider vendor can help.
How the setup process works
1
Gather information – You compile the Discovery Endpoint, Client ID, Client Secret, and role mapping, and submit them to our support team.
2
Setup by talentsconnect – Our team configures the SSO integration in your talentsconnect Home.
3
Joint test session – We schedule a session with your technical contact. During this session, we exchange the Redirect URIs and jointly test whether the integration is working correctly.
4
SSO active – After a successful test, SSO is available for your users in talentsconnect Home.
ℹ️ Alternative: If a joint test session is not possible, a test user can alternatively be provided for our team so that we can test the integration independently.
Frequently asked questions about SSO setup
Which Identity Providers are supported?
In principle, all Identity Providers that support OpenID Connect (OIDC) – e.g. Microsoft Azure AD, Okta, Keycloak, Google Workspace, and many more. Please contact our support team if you are unsure about your provider.
What is a Redirect URI and where do I get it?
The Redirect URI is the URL to which your Identity Provider redirects users after a successful login. This URL is provided by talentsconnect and exchanged with you during the joint setup session. You must register it as an allowed Redirect URI in your Identity Provider.
Can SSO be set up for multiple JobShops at the same time?
Yes, SSO can be set up for both talentsconnect Home and internal job boards (Internal Jobboard). Please contact our support team if you need SSO for multiple areas.
How do I contact support?
Create a support ticket via our Help Center and include your company name and the desired Identity Provider. Our team will then get back to you with the next steps.