Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/23.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=authentication-openid-connect

OpenID Connect

OpenID Connect (OIDC) is an identity layer built on OAuth 2.0 that provides authentication and single sign-on (SSO) capabilities. With OpenID Connect, users can sign in to multiple applications and services using a single set of credentials managed by an external identity provider (IdP).

Sophos Firewall supports OpenID Connect authentication through external identity providers, allowing organizations to use existing cloud-based identity services for user and administrator authentication. This simplifies account management and provides a consistent sign-in experience across supported firewall services.

OpenID Connect identity providers

The OpenID Connect supports the following IdPs:

  • Microsoft Entra ID
  • Google Workspace

When adding an authentication server, select OpenID Connect as the server type and then choose the appropriate IdP.

You can identify the IdP vendor of your OpenID Connect server in the Type column in Authentication > Servers.

Although both IdPs are configured through the OpenID Connect server type, the authentication requirements differ.

  • Microsoft Entra ID

    Microsoft Entra ID supports OpenID Connect (OIDC) authentication and continues to work with existing Microsoft Entra ID authentication deployments.

    Microsoft Entra ID

  • Google Workspace

    Google Workspace authentication supports user authentication and group-based authorization. Since Google Workspace doesn't provide group membership information in standard OpenID Connect authentication responses, additional Google Workspace configuration is required to retrieve user group information.

    Google Workspace

Note

You can select only one IdP server for each firewall service. See Services.

Supported services

You can use OpenID Connect SSO authentication with the following Sophos Firewall services:

  • Web Admin Console
  • Captive Portal
  • VPN Portal
  • Remote access SSL VPN
  • Remote access IPsec VPN

Note

macOS devices running Sophos Connect client 2.1 or later only support Microsoft Entra ID SSO for IPsec VPN, SSL VPN, and provisioning connections. See How to use Sophos Connect.

How OpenID Connect authentication works

When a user attempts to access a protected service, the firewall redirects the user to the configured IdP for authentication. After the user's identity is verified, the IdP returns authentication information to the firewall, which then grants access to the requested service.

OIDC uses standardized authentication endpoints and token formats, allowing the firewall to integrate with supported identity providers through a consistent framework. The key OIDC capabilities are as follows:

  • SSO authentication.
  • Integration with supported cloud IdPs.
  • Automatic discovery of identity provider settings.
  • Standardized user identity and attribute mapping.
  • Secure authentication using industry-standard OpenID Connect protocols.

How SSO for web admin console works

To implement SSO for the web admin console, you must configure IdP groups or roles in the IdP and map them to device access profiles in the firewall.

When a user signs in to the web admin console using SSO, the firewall examines the token from the IdP for a role value or group name. If the token contains a role value or group name that matches an IdP attribute mapping rule, the firewall assigns the first matching device access profile.

When it finds a match, the firewall allows the sign-in, creates or updates the administrator account, and applies the permissions configured in the assigned device access profile.

Note

If the token doesn't contain a role value or group name, or if it doesn't match an IdP attribute mapping rule, sign-in to the web admin console fails.

The firewall creates and updates administrator accounts only when users sign in to the web admin console. When users sign in through the captive portal, VPN portal, remote access IPsec VPN, or remote access SSL VPN, the firewall authenticates them as regular users and doesn't create or update administrator accounts.