Authentication
Single Sign-On (SSO)
OIDC

Configure OIDC SSO to Kensho

Let your users sign in to Kensho with your organization's identity provider (IdP) over OpenID Connect (OIDC). Kensho works with any OIDC provider.

Supported features

  • SP-initiated SSO: sign-in starts from Kensho.
  • IdP-initiated SSO: sign-in starts from a Kensho tile in your IdP dashboard.
  • Just-In-Time (JIT) provisioning: a matching Kensho account is created on first sign-in.

Prerequisites

Before you configure OIDC for Kensho, you need the following:

  • Administrator access to your IdP.
  • The corporate email domain(s) that your users sign in with (for example, @example.com). Kensho routes sign-ins to your org by matching this domain.
  • A secure way to share your OIDC client credentials with the Kensho support team. Secure email is recommended.

Configuration steps

Select your identity provider.

  1. In the Okta Admin Console, go to Applications → Applications.
  2. Click Browse App Catalog.
  3. Search for and select the Kensho app.
  4. Click Add Integration.
  5. On the General Settings tab, leave the SSO ID and Audience URI fields blank (they apply only to SAML), then click Next.
  6. On the Sign-On Options tab, select OpenID Connect, then click Done to finish adding the integration.
  7. On the app's General tab, copy the Client ID and Client secret.
  8. On the Assignments tab, assign the users and groups who need access to Kensho. Only assigned users can sign in.

Then complete the connection with Kensho:

  1. Contact the Kensho support team (support@kensho.com) and request OIDC SSO for your account. Send the following through a secure channel (secure email is recommended):
    • Your Client ID and Client secret.
    • Your OIDC issuer URL, so Kensho can find your OIDC endpoints.
    • The corporate email domain(s) your users sign in with.
  2. Kensho configures and activates the connection.

Your OIDC configuration for Kensho is complete. Kensho creates each user's account on their first sign-in (JIT provisioning).

Claims

Kensho reads the email, given_name, and family_name claims from your provider to create each user. Most providers return these by default for a web application, so no extra configuration is required.

Roles

If you want different groups of users to receive different entitlements, send a division claim. You choose the values and how each user's division is set. For example, investment-banking and asset-management users could receive different entitlements. Share your planned values with Kensho ahead of time, and Kensho maps each one to the right entitlements.

Use short identifiers without spaces (letters, digits, hyphens, or underscores). Kensho matches the values you send against the ones you shared, so a value that doesn't match won't grant any entitlements.

SP-initiated SSO

The sign-in process is initiated from Kensho.

  1. From your browser, navigate to kensho.okta.com (opens in a new tab) or sign in to any Kensho application.
  2. Enter your corporate email address and continue.
  3. You are redirected to your IdP, authenticate there, and are then redirected back to Kensho.

Troubleshoot

For help configuring or debugging a connection, contact the Kensho support team at support@kensho.com.