Docebo for OpenID Connect

Introduction

OpenID Connect (opens in a new tab) is a simple identity layer on top of the OAuth 2.0 protocol. It allows you to verify the identity of users based on the authentication performed by an Authorization Server, and to obtain basic profile information about them in an interoperable way. Docebo supports the OpenID Connect Authorization Code flow, which is one of the available flows for authentication. Please refer to the OpenID Connect technical documentation (link opens in a new tab) for further information.

By activating the OpenID Connect app in your Docebo platform, users will be able to log into their Docebo platforms using the credentials from active sessions of other web platforms.  When the app is active, users can press the OpenID Connect icon in the Docebo login page to connect to the platform with the credentials of other web platforms, and will also be allowed to log into the Docebo platform from the OpenID Connect dashboard, by pressing the Docebo platform icon. If a user requesting to login does not exist in Docebo yet, he or she will be automatically created at the first login.

This article will give you a step-by-step process of how to activate and configure the app. Please note that the integration with OpenID Connect is available for Docebo’s Extended Enterprise App.

Please note: When using OpenID Connect, you can integrate a single Identity Provider per platform domain. If you need to integrate other identity providers for the same domain, please use another protocol.

The mobile application Go.Learn supports most OpenID Connect authentication configuration examples described in this article.

Best practice: When an SSO integration and a custom domain are set up at the same time, it is strongly suggested to configure the custom domain in Domain Management first. The endpoint URLs needed for the SSO integration are dependent on the URL of the platform.

Activating the OpenID Connect app

Activate the OpenID Connect app as described in the Managing Apps & Features article of the Knowledge Base. The app is listed in the Single Sign On tab.

Once it’s activated, you can begin the configuration. Please refer to the section below to learn more.

Configuring the OpenID Connect app

To begin the configuration for this app, log into your platform as Superadmin and access the Admin menu from the gear icon on the top right corner. Then, find the OpenID Connect section in the Admin Menu and press the Manage subitem. You will be redirected to the OpenID Connect Settings page.

The URLs listed in the Platform URLs section are automatically generated by your platform, and must be passed to your Identity Provider for a proper configuration of the Docebo platform in their platforms:

Login URL

3rd-party application login page for federated authentication using OpenID Connect

Logout URL

Logout URL used to log the current user out of the 3rd-party application

Please note: If you want to use OpenID Connect SSO on your Go.Learn or branded mobile app, you need to add the golearn://sso_logout URL to the list of sign-out redirect URIs (also called logout redirect URIs or callback URLs) on the Identity Provider configuration page.

Code URL

Redirect URL of the 3rd-party application for OpenID Connect code responses.

Please note: If you want to use OpenID Connect SSO on your Go.Learn or branded mobile app, you need to add the ?device=mobile parameter at the end of the code URL when copy-pasting the code URL from Docebo to the Identity Provider configuration page.

The OpenID Client section must be filled in with the details of the Identity Provider you are integrating. Copy and paste this data from the provider into this section in your Docebo platform. Check the technical documentation of your identity provider for information on how to obtain this data. If your Identity Provider is OKTA, OneLogin, Salesforce, Microsoft Entra ID, Microsoft Azure AD B2C or Ping Identity, you’ll find Configuration Examples listed at the end of this article.

Issuer

The authorization server’s complete URL

Client ID

The client ID of the client requesting to access the token

Client Secret

This client secret is used in conjunction with the Client ID to authenticate the client application

Metadata URL

Returns OpenID Connect metadata related to the specified authorization server. The Metadata URL provides all the data configurable in the second section of the OpenID Connect configuration page.

Use the Auth Type section to select whether to activate the Basic Auth or the Query String Authentication type, depending on the Identity Provider you are using. The Basic Auth type is the default selection because it’s the most commonly used. Please refer to the documentation of your Identity Provider to retrieve this information.

Press Continue to activate the second slot of parameters, and proceed with the configuration. The upcoming options are self-populated by the Metadata URL.

• You can press Reset at any time to start the configuration from scratch. In this case, after you complete the first slot of parameters and press Continue, also press Save changes at the end to refresh the page and properly retrieve the options from the Metadata URL.

Username attribute

In the Username Attribute section, select one of the options that are auto-provided by the Identity Provider. The attribute that you select will be the username for your users in the Docebo platform. When making your selection, make sure that the selected attribute is populated for all your users in the Identity Provider. Please note that the selected attribute must be a unique identifier. For example, if you select Family Name as username attribute, you must be sure that none of your users have the same family name. We suggest selecting Email as Username Attribute.

Also remember that if you selected the First Name and Last Name are required in order to register option in the Self Registration tab of the Advanced Settings section of Docebo Admin Menu, the Identity Provider must provision the users' first and last names for a proper registration to the platform.

Scope

The elements of the Scope list are also auto-populated and depend on the endpoint. This is a list of the available profile information retrieved by the Metadata URL inserted in the OpenID Client section. Select the user data you want to retrieve from the Identity Provider via ID Token by checking the corresponding checkboxes. Please note that Email and Profile are mandatory scopes and must always be checked.

The selected options in this section identify the data that will populate the user profile when the user is created in the platform, at first login. If the ID Token includes additional fields, group or branch assignments to Docebo, this information will be taken into account, and populated in the Docebo platform.

Token exchange method

Use this setting to define how the system sends the JWT data request to the Identity Provider. By default, Docebo sends requests via the URL using GET parameters. When using the POST option, Docebo sends requests via the URL using POST parameters, adding them to the BODY of the call.

The GET option is simpler and sends the data through the URL, while the POST option is more complex, but uses a more effective encryption method.

Please Note: This option is set to GET by default. When using this setting, make sure you have properly configured your Identity Provider according to the selected option.

Both the GET and the POST requests send the following data for the authorization code authentication type:

Code

The Code value exchanged by the OpenID standard, when using the authorization code authentication type

Redirect URI

The URI where Docebo sends the JTW.

When using the basic auth authentication type, the following data is also sent:

• Client ID
• Client Secret

State parameter validation 

It is recommended to set the option to Enforce and validate state parameter, as this provides increased security. Deselect this option only if your identity provider is not configured for sending or validating the state parameter.

Certification rotation

When the Certification Rotation option is enabled, the Docebo platform will retrieve the key that is valid at the time of the request from an URL defined by the OpenID Connect standard. The Identity Provider will auto-enable the option to refresh the certification autonomously. This is part of the standard relation, and it is either auto-flagged or not.

If the Identity Provider does not support the certification rotation, but this option is enabled, an error message will be shown.

SSO behavior

The SSO behavior can be configured in two different ways. Define whether you want to show the standard Docebo platform login page, or if you want to automatically redirect the users to the Identity Provider dashboard. When the first option is flagged, define whether you want to show the SSO button on your platform’s login page.

When selecting the option for an Automatic redirect to Identity Provider, you can set a specific logout landing page when your users log out of the platform instead of keeping the standard logout page. Use the text box to type in the URL of the logout landing page.

Logout behavior

The Logout Behavior section allows you to configure if users will be automatically logged out from the Identity Provider when they log out from the Docebo platform. As an additional option, you can select a custom third-party logout endpoint, able to receive the logout message via GET in order to complete the Single LogOut; this option is supported by a few Identity Providers.

In this section you can also activate the switch to not send id_token_hint. Please note that Docebo does not recommend using this option.

User provisioning

This section allows you to instantly create a user who is present in your Identity Provider but not yet present in the database. Begin by flagging the Enable option. You can also flag the option to lock provisioned user fields, meaning that users cannot edit details in their user profiles that have been created via OpenID Connect. When editing the user profile, the options will be greyed out.

If there are users existing in both databases, we suggest you flag the option to update the user information for the existing users. Please note that when these options are not flagged, you will have to manually register (enable option) or update your users (update information) in the Docebo platform.

Please note that OpenID Connect automatically populates the Identity Provider additional fields, so remember to select them one by one from the Add Fields dropdown menu and associate them to the Docebo user additional fields in the section displayed for each additional field after the selection. Please remember that if you set some user additional fields as mandatory in your Docebo platform, they must be mapped in this section in order to be populated in your platform. If the mandatory additional fields are not populated, the user will not be created.

Click Save Changes to complete the configuration.

The Additional Field types that are supported for user provisioning in this integration are:

• Dropdown (use the dropdown ID in the Attribute statement)
• Text Field
• Fiscal Code - Country (use the ID of the country in the Attribute statement)
• Date Field (format: YYYY-MM-DD)
• Yes/No Field

Additional Field types that are not supported:

• IFrame
• File Field
• Free Text Field

Notes about user provisioning:

• If you wish to populate the country user additional field via SSO, an acceptable value would be either the Country ID or Country Name as listed in the article titled List of ISO 3166-1 Countries.
• The Language user attribute is not supported when provisioning users.

Configuration examples

This section provides you with some examples of how to configure and integrate some of the most popular Identity Providers. If your vendor is not listed here, please refer to the above documentation.

• Okta configuration example
• OneLogin configuration example
• Salesforce configuration example
• Microsoft Entra ID configuration example
• Microsoft Azure AD B2C configuration example
• Ping Identity configuration example

Okta

When configuring Okta with OpenID Connect, the Okta app does not need to be activated in your platform. Start by connecting to the Okta website as an Admin, click on Admin on the top right corner, then move to the Applications tab and click Add Application to create the Docebo App in Okta, registering it as a Service Provider. Click on Create New App.

In the pop-up box, select Web as Platform Type and OpenID Connect as Sign On Method. Press Create to proceed. Type the Application Name (can either be Docebo, or the App as renamed for your company) and add a logo to identify the App in the OpenID Connect dashboard. The logo upload is optional but can be very useful to quickly identify the Docebo platform in the OpenID Connect dashboard.

Open the OpenID Connect configuration page in Docebo (Admin Menu → OpenID Connect → Manage), and copy the values shown in the Platform URLs section in the corresponding fields of the Configure OpenID Connect section of the Create OpenID Connect Integration page in Okta. In the Login redirect URIs section, copy and paste the Login URL and the Code URL values from Docebo, in this order. Press Add URI button to insert a new row.  Copy and paste the Logout URL value from Docebo in the OKTA’s Logout redirect URIs section. Press Add URI button to insert a new row. Press Save to proceed.

Retrieve now the OpenID Connect information from the Configure OpenID Connect section of the Create OpenID Connect Integration page in Okta, and paste them into the Open ID Client section of the OpenID Connect configuration page in Docebo. Move to the General tab, copy the Client ID and the Client Secret values, and copy them into the corresponding fields in Docebo. Retrieve the Client Issuer code from your OKTA installation URL: copy the URL from https up to the end of the domain name (i.e https://{yourdomainname}.oktapreview.com/) and paste it in the Issuer.

Finally, compose the Metadata URL value as follows:

  {{url}}/.well-known/openid-configuration?client_id={{clientId}}

according to:

{{url}}

The Issuer Code (including the https or the http protocol), remove {{ }}

{{clientId}}

The Client ID value, remove {{ }}

Copy the resulting URL and paste it as Metadata URL value in Docebo.

On the Okta website, define the users allowed to use the app. Move to the Assignments tab and add the users, either one by one or with mass action. Click Assign and select either Assign to People or Assign to Groups, depending on your needs. Select the users and/or the groups previously created in Okta, click on Assign and Done to complete the action.

The Docebo configuration on Okta is completed. Move back to Docebo, set the Auth Type value to Basic Auth and click on Continue to proceed and activate the parameters of the second part of the configuration. Complete the configuration by following the instructions provided in the first part of this article.

OneLogin

When configuring OneLogin with OpenID Connect, the OneLogin app does not need to be activated in your platform. Start the configuration from the Identity Provider. Login to OneLogin (link opens in a new tab), click on Administration on the page upper bar, select the Apps tab and click on Custom Connectors.

Create a custom connector in order to register Docebo as Service Provider. Click on New Connector on the top right corner. Enter your Docebo App Name (i.e yourtrial.docebosaas.com) and press Thick to confirm. You will see the Basic Configuration page. Add an icon to identify the App in the OpenID Connect dashboard. The icon upload is optional but can be very useful to quickly identify the Docebo platform in the OpenID Connect dashboard. In the Sign On Method section, select OpenID Connect.

Open the OpenID Connect configuration page in Docebo (Admin Menu → OpenID Connect → Manage), and copy the values shown in the Platform URLs section in the corresponding fields in OneLogin, as follows. In the OneLogin OpenID Connect section, paste the Docebo Code URL in the redirect URI field. Move to the Login URL section and paste the Login URL in the Login URL field. Press Save to continue.

Please note: OpenID Connect enables service-provider-initiated (SP-initiated) SSO, but not identity-provider-initiated (IdP-initiated) SSO. When you provide a Login URL, OneLogin mimics an IdP-initiated SSO experience: the user is taken to the app’s login page, where the SP-initiated authentication flow begins. Refer to the OneLogin Knowledge Base (opens in a new tab) for further info. When configuring the integration with Docebo, type the pure platform URL (https://[platformname].docebosaas.com) in the Login URL field in OneLogin, and set the SSO behavior to Automatic Redirect in Docebo OpenID Connect configuration page.

Move to the Apps tab, select Add Apps and search for OpenID Connect in the search bar. Select OpenId Connect (OIDC) among the search results listed in the Find Application page. Either confirm or select your subscription plan and press Continue. Insert the App name and description. In the Configuration tab, copy and paste the Login URL from Docebo in the Login Url fields and the Code URL and the Logout URL in the Redirect URI section, as separate lines. Press Save to proceed.

Retrieve the OpenID Connect information from OneLogin. The Issuer code comes from the OneLogin website URL: copy the link from HTTPS to the last letter before the first single slash (do not copy the slash). Next, move to the SSO tab.

Copy the Client ID and the Client Secret and paste them in the corresponding fields of the Open ID Client section of the OpenID Connect configuration page in Docebo (Admin Menu → OpenID Connect → Manage).

Finally, compose the Metadata URL value as follows:

{{url}}/oidc/.well-known/openid-configuration

Where url is the Identity Provider URL, remove {{ }}

Define now the users allowed to use the app. Move to the Users tab and insert the user accounts that will be able to connect using this Identity Provider.

The Docebo configuration on OneLogin is completed. Move back to Docebo, set the Auth Type value to Basic Auth and click on Continue to proceed and activate the parameters of the second part of the configuration. Complete the configuration by following the instructions provided in the first part of this article.

Salesforce

When configuring Salesforce with OpenID Connect, the Salesforce app does not need to be activated on your platform. Start the configuration from the Identity Provider. Login to Salesforce (link opens in a new tab), click on  Setup on the page upper bar. From the left-side menu, reach the Build section, select Create, and finally Apps.

From the Apps page, move to the Connected Apps section, and click New to add Docebo as new application.

In the New Connected App page that will open, type the Connected App Name and a Contact email address in the corresponding sections. Move now to the API (Enable OAuth Settings) section and flag the Enable OAuth settings option. When this option is selected, several configuration options will be shown underneath.

Open now the OpenID Connect configuration page in Docebo (Admin Menu → OpenID Connect → Manage), and copy the values shown in the Platform URLs section in the corresponding fields of this page. In the Callback URL, paste both the Login URL and the Code URL values on two separate lines, without separation characters.

Define now the Selected OAuth Scope by adding Allow access to your unique identifier and Access your basic information (id, profile, email, address, phone) to the Selected OAuth Scope box. Check the Configure ID Token option and select Include standard claim from the options shown underneath. If needed, enable the Enable Single Logout option and copy and paste the Docebo Logout URL.

Press Save to complete the configuration. Please note that once you save, it may take up to ten minutes for your App to be created. When the creation procedure is over, you will be redirected to the page of the app you have just created.

Retrieve now the OpenID Connect information for Docebo. The Issuer code comes from the website URL, copy the link from HTTPS to the last letter before the single slash. Copy the Consumer Key and the Consumer Secret values (click on Click to Reveal to see the code in clear) and paste them in the Client ID and in the Client Secret into the Open ID Client section of the OpenID Connect configuration page in Docebo (Admin Menu → OpenID Connect → Manage).

Finally, compose the Metadata URL value as follows:

{{url}}/.well-known/openid-configuration

Where url is the Identity Provider URL, remove {{ }}

The Docebo configuration on Salesforce is completed. Move back to Docebo, set the Auth Type value to Query String, and click on Continue to proceed and activate the parameters of the second part of the configuration. Complete the configuration by following the instructions provided in the first part of this article.

When users log in to the platform for the first time using Salesforce, they will be asked to confirm that Docebo can access their data before proceeding. Please note that if users do not allow Docebo to access their data, then they will not be able to log in.

Microsoft Entra ID (formerly Microsoft Azure Active Directory)

Start the configuration from the Identity Provider (if you are planning to use the integration with a custom domain, make sure your SSL certification is valid).

Sign in to the Microsoft Entra admin center (opens in a new tab) as an administrator.

Register the app:

1. Browse to Identity > Applications > App registrations and select New registration.
2. Enter the display Name for your application and the supported account types.
3. Select Register to complete the initial application registration.

Client ID:

When registration finishes, the Overview panel shows the details of your newly registered app. Copy the application (client) ID and paste it into the Client ID field on the Docebo Open ID connect configuration page.

 

Redirect URIs:

Now in the left navigation panel, under Manage, select Authentication. Then under Platform configurations, select Add a platform, and under Configure platforms, select the Web tile.

1. In the Web expander, under the Redirect URIs section, add the Login URL and Code URL, both copied from the Docebo Open ID connect configuration page.
2. Under Implicit grant and hybrid flows, select the types of tokens you want to be issued by the authorization endpoint (ID tokens, Access tokens, or both).
   1. Note that Access tokens must be selected if you set the option to retrieve claims through the user info endpoint on the Docebo Open ID connect configuration page.

Client secret:

1. In the left navigation panel, under Manage, select Certificates & Secrets.
2. Select the Client secrets tab and click New client secret.
3. Add a description for your client secret and set its expiration, then click Add.

Copy the secret’s Value and store it in a safe place. This secret value is never displayed again after you leave this page.

• Paste the secret Value into the Client secret field of the Docebo Open ID connect configuration page.

Metadata and Issuer:

Return to the app Overview panel, and from there in the top navigation select Endpoints.

1. Copy the OpenID Connect metadata document URI and paste it into the Metadata URL field of the Docebo Open ID connect configuration page.
2. Next, paste the same OpenID Connect metadata document URI into the browser address bar and navigate to the page, which is a JSON file.
3. Search the JSON page for the string issuer and note the issuer URL which should look similar to this https://login.microsoftonline.com/{tenantid}/v2.0.
4. Copy this issuer URL and paste it into the Issuer field of the Docebo Open ID connect configuration page.

Check open ID Connect configuration fields on Docebo platform

At this point of the configuration, you should have completed all the fields in the OpenID client section of the Docebo Open ID Connect configuration page: Issuer, Client ID, Client secret, and Metadata URL.

Finishing steps:

To complete the configuration of the communication between Docebo and Microsoft Entra ID:

• Set the Auth Type value as required by your identity provider. Refer to the first part of this article for more information.
• Click Continue to proceed and activate the parameters of the second part of the configuration.
• Complete the configuration by following the instructions provided in the first part of this article. When you are finished click Save changes.

When a user logs in to Docebo via Microsoft Entra ID for the first time after the configuration, a pop-up message will prompt the user to grant the necessary permissions to the Docebo app.

• The user must press Accept to continue. Please note that without this access permission, the integration will not work.

Microsoft Azure AD B2C

Please note: The go.Learn mobile app is incompatible with Microsoft Azure AD B2C when at the time of registering a new app you select either of the following from the list of Supported Account Types:

• Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)
• Personal Microsoft accounts only

Start the configuration from the Identity Provider (if you are planning to use the integration with a custom domain, make sure your SSL certification is valid). Connect to the Microsoft Azure Active Directory website as an Admin. From the search bar in the top area of the All Services page, look for Azure AD B2C and select it from the search results. For more information about connecting to the B2C Azure website please read the notification on Microsoft's website (opens in a new tab).

Once on the Azure AD B2C page, select App registrations from the Manage menu. Next, in the App registrations page, press the New registration button.

Next, press the Authentication tab in the Manage menu and press the Add a platform button. In the following Configure platforms screen, press the Web button in the Web applications section.

Then, in a separate browser window open your Docebo Platform and navigate to the Admin Menu, locate the OpenID Connect section and press Manage. In the resulting window, locate the Platform URLs section and copy the Code URL value to your clipboard.

Return to the Azure AD B2C browser tab and in the Configure Web window, paste the URL into the first text box labeled Enter the redirect URI of the application. Then, return to the Docebo Platform tab and copy the Logout URL to your clipboard. Returning to the Azure AD B2C browser tab, paste the URL into the Front-channel logout URL text box.

Next, access the Certificates & secrets entry in the Manage menu and in the Client Secrets tab, press the New client secret button. Then, in the Add a client secret window, enter a description for the client secret, select the Recommended expiration duration of 180 days and press the Add button.

Returning to the Client secrets tab, your new client secret value will be visible in the list. Press the Copy to Clipboard icon next to the client secret value and then return to the Docebo Platform tab. There, navigate to the Admin Menu and access the Advanced Settings item located in the Settings menu.

In the Advanced Settings, access the OpenID Connect Settings menu item and In the OpenID Client section, paste the contents of your clipboard into the Client Secret field.

Next, to retrieve the value to paste into the Issuer field in the OpenID Client section, return to the Azure AD B2C tab of your browser and access the Overview area located above the Manage menu. Copy and paste the Tenant ID displayed on this page into a text editor, such as Notepad, as you will need to insert it later. Then, press the Endpoints button and in the resulting window, press the copy to clipboard button located in the OpenID Connect Metadata Document field.

Paste this URL into your text editor for later use, also.

Next open a new tab in your browser and paste the URL into the address bar. Perform a search on the page for the string issuer and note the URL which should look similar to this:

https://login.microsoftonline.com/{tenantid}/v2.0

Replacing {tenantid} with your Tenant ID will give you the URL you need to paste into the Issuer value in the OpenID Connect Client section.

To find the Metadata URL, return to your text editor and in the URL you pasted there, replace the word organizations with your Tenant ID. You can now paste this updated URL into the Metadata URL field of the OpenID Connect Client section.

https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration

The configuration of the communication between Docebo and Microsoft Azure AD B2C is complete. Set the Auth Type value to Query String and click on Continue to proceed and activate the parameters of the second part of the configuration. Complete the configuration by following the instructions provided in the first part of this article. When a user logs in to Docebo via Microsoft Azure AD B2C for the first time after the configuration, a pop-up message will ask him/her to confirm that he/she allows the Docebo app to access the data stored in Microsoft Azure Active Directory and to view his/her basic profile. Press Accept to continue. Please note that if you do not provide your permission, the integration will not work.

Ping Identity

When configuring Ping Identity with OpenID Connect, there is no Ping Identity app to be activated in your platform. Start the configuration from the Identity Provider.

Log in to Ping Identity with your administrator account and in the Applications Tab under Connections, choose Add Application by clicking on the plus icon.

You will next be presented with a choice of application type, press the Web App button followed by the Configure button in the resulting pop-up.

Next, give the application a name of your choice, add an icon (if desired) and press the Next button.

Next, you will need to find the appropriate URLs to use within the platform. Open a new tab and in Docebo click on the gear icon, find OpenID Connect and click on Manage. The top three URLs are what you are going to need for the next step in Ping Identity.

Paste the three URLs into the Redirect URLs box and press the Save and Continue button.

You will next be presented with a list of available scopes to use with your configuration. In order to minimize the amount of unnecessary data being exchanged between systems and for security purposes choose only the OpenID scopes that are necessary for the platform and press the Save and Continue button.

In the next screen, you may customize the Attribute Mapping to suit your needs, if necessary. The default settings do not need to be changed in order for Ping Identity to function properly. Press the Save and Close button to continue.

On the next screen press the pencil button to the right of the displayed configuration to edit your newly created configuration. Find the Redirect URIS box and copy/paste the URL ending in “logout” to the Signoff URLs box below. Then press the Save button.

You will then be presented with a list of URLs that need to be copied into the OpenID Connect Management screen, in the Docebo platform. The fields needed within the platform correspond to the same information given in Ping Identity except for Metadata URL which is the URL named OIDC Discovery Endpoint in Ping Identity. Then click on the Continue button.

Next in the Scope section select all required entries corresponding to the scopes you defined in Ping Identity. Under Token Exchange Method choose Post and under SSO Behavior check the box next to Show SSO button on login page. Then move to the User Provisioning section and check Enable and If user already exists, update the user information.

Press the Save Changes button in OpenID Connect and you will now be able to log into your platform using Ping Identity.

Authentication flow

As of October 26, 2021, Docebo has implemented a short-lived token in order to provide better security:

Previous authentication flow

Before October 26, 2021, the Docebo platform would send a request to the Identity Provider (IdP) and receive a persistent access token.

Each SSO has a slightly different process, but all of them return a link to Docebo with the access token in the URL:

https://mylms.docebosaas.com/learn/home;type=oauth2_response;reenter_cc=0;access_token=9b8de7ed2af145dee78aa4282bf1d3b17baf02cd;expires_in=3600;token_type=Bearer;scope=api

Short-lived token authentication flow

The updated authentication flow provides added security by replacing the IdP provided single-use short-lived token with an internally used access token:

Each SSO has a slightly different process, but all of them return a link to Docebo with the short lived token in the URL. The short lived token is a one use short lived (with a lifespan of 30 seconds) token that can be exchanged for real credentials:

https://mylms.docebosaas.com/learn/signin;type=token_exchange;exchange_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSU

Docebo automatically and internally using POST calls exchanges it for the real access token. This increases security but does not change the overall behavior of the SSO.