{"id":98495,"date":"2026-10-27T09:00:00","date_gmt":"2026-10-27T07:00:00","guid":{"rendered":"https:\/\/churchtools.academy\/help\/non-knowledgebase\/uncategorized\/oidc-authentication-with-churchtools\/"},"modified":"2026-11-05T09:45:10","modified_gmt":"2026-11-05T07:45:10","password":"","slug":"oidc-authentication-with-churchtools","status":"publish","type":"docs","link":"https:\/\/churchtools.academy\/en\/help\/system-settings\/oauth-oidc-and-saml\/oidc-authentication-with-churchtools\/","title":{"rendered":"OIDC Authentication with ChurchTools"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Here, we&#8217;ll explain how to connect an external Login provider to your ChurchTools using OIDC. This allows your users to use their Login credentials from a third-party system\u2014such as Microsoft 365\u2014to log in to your ChurchTools.<\/p>\n\n<aside class=\"wp-block-group ct-box ct-box-blue has-background is-vertical is-layout-flex wp-container-core-group-is-layout-1ccdadb1 wp-block-group-is-layout-flex\" style=\"border-radius:8px;border-left-color:#3e70ce;border-left-width:0.5rem;background-color:#f3f5f7;margin-top:var(--wp--preset--spacing--60);margin-bottom:var(--wp--preset--spacing--60)\">\n<p class=\"wp-block-paragraph\" style=\"margin-top:0.5rem;margin-right:0.5rem;margin-bottom:0rem;margin-left:0.5rem\"><strong>Hinweis<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"margin-top:0rem;margin-right:0.5rem;margin-bottom:0.5rem;margin-left:0.5rem\">Setup with an external provider varies depending on the system. Refer to the provider\u2019s official documentation or speak with the IT staff at your congregation or denomination. This guide therefore describes only the settings in ChurchTools.<\/p>\n<\/aside>\n\n<h2 class=\"wp-block-heading\">1. Register ChurchTools with the provider<\/h2>\n\n<p class=\"wp-block-paragraph\">Create an application for your ChurchTools system with the provider. Some providers also refer to this as a \u201cclient.\u201d If you\u2019re asked to select an application type, choose <strong>\u201cConfidential Client\u201d<\/strong> and the <strong>\u201cAuthorization Code\u201d flow<\/strong>. For some providers, such as Google, be sure to specify <strong>\u201cExternal\u201d<\/strong> as the target audience.<\/p>\n\n<p class=\"wp-block-paragraph\">Next, open the <em>System Settings<\/em> in ChurchTools via the <em>Manage menu<\/em>. Under <em>General<\/em>, go to <em>Login<\/em>. The <strong>provider endpoints <\/strong>are <strong>displayed <\/strong>here (see also <a href=\"https:\/\/churchtools.academy\/en\/help\/system-settings\/login-systemeinstellungen\/login-to-and-with-churchtools\/\" data-type=\"docs\" data-id=\"43227\">\u201cLogging In to and With ChurchTools\u201d<\/a>).<\/p>\n\n<p class=\"wp-block-paragraph\">Copy the <strong>OIDC redirect URI <\/strong>that is displayed <strong>and <\/strong>enter it as an allowed redirect URL with the provider. Enter it exactly as shown and do not change it.<\/p>\n\n<p class=\"wp-block-paragraph\">During or after setup, the provider should display the <em>issuer address<\/em>, <em>client ID<\/em>, and <em>client secret<\/em>. Keep these handy for further configuration of your ChurchTools.<\/p>\n\n<h2 class=\"wp-block-heading\">2. Add an OIDC provider to ChurchTools<\/h2>\n\n<p class=\"wp-block-paragraph\">In the <em>&#8220;Login to ChurchTools via a Third-Party System<\/em> &#8221; section, click the blue <strong>&#8220;+ Add Login Provider<\/strong> &#8221; button and select &#8221; <strong>OIDC<\/strong>&#8221; from the menu.<\/p>\n\n<p class=\"wp-block-paragraph\">Fill in the fields with the appropriate information. The following screenshot shows an anonymized example. When setting up the provider, enter your provider\u2019s actual information.<\/p>\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-hinzufuegen.png\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1922\" height=\"1354\" src=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-hinzufuegen.png\" alt=\"Screenshot of the &quot;Add Server&quot; dialog box\" class=\"wp-image-97971\" srcset=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-hinzufuegen.png 1922w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-hinzufuegen-300x211.png 300w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-hinzufuegen-768x541.png 768w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-hinzufuegen-1024x721.png 1024w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-hinzufuegen-1536x1082.png 1536w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-hinzufuegen-360x254.png 360w\" sizes=\"(max-width: 1922px) 100vw, 1922px\" \/><\/a><\/figure>\n\n<figure class=\"wp-block-table is-style-stripes\"><table><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Field<\/th><th class=\"has-text-align-left\" data-align=\"left\">What are you entering?<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-left\" data-align=\"left\">Name<\/td><td class=\"has-text-align-left\" data-align=\"left\">A clear name that helps your users identify the provider; for example, \u201cLogin with Google\u201d for a Google integration.<\/td><\/tr><tr><td class=\"has-text-align-left\" data-align=\"left\">Issuer<\/td><td class=\"has-text-align-left\" data-align=\"left\">The exact issuer address as specified in the provider&#8217;s documentation or configuration. Any trailing slash is part of the address.<\/td><\/tr><tr><td class=\"has-text-align-left\" data-align=\"left\">Discovery URL<\/td><td class=\"has-text-align-left\" data-align=\"left\">This is automatically derived from the issuer. You do not need to enter the individual registration and token addresses manually.<\/td><\/tr><tr><td class=\"has-text-align-left\" data-align=\"left\">Client ID<\/td><td class=\"has-text-align-left\" data-align=\"left\">The identifier of the application you registered with the ChurchTools provider.<\/td><\/tr><tr><td class=\"has-text-align-left\" data-align=\"left\">Client Secret<\/td><td class=\"has-text-align-left\" data-align=\"left\">The secret associated with this application. It is required when creating the application. If you leave it blank when editing later, the saved secret will remain unchanged.<\/td><\/tr><tr><td class=\"has-text-align-left\" data-align=\"left\">Scope<\/td><td class=\"has-text-align-left\" data-align=\"left\">Normally, there are three scopes: &#8220;<code>openid profile email<\/code>.&#8221; Multiple scopes are separated by spaces. Enter additional scopes only if the provider specifies that they are required to obtain the necessary information.<\/td><\/tr><tr><td class=\"has-text-align-left\" data-align=\"left\">Create New People<\/td><td class=\"has-text-align-left\" data-align=\"left\">If no matching person is found, a new person can be created automatically.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">Finally, add the Login provider.<\/p>\n\n<h2 class=\"wp-block-heading\">3. Test OIDC registration<\/h2>\n\n<p class=\"wp-block-paragraph\">Click on the newly created login provider to open its details page. Here you&#8217;ll find all the connection details again. At the bottom of the page, you can now <strong>test<\/strong> the <strong>OICD registration<\/strong>. Click the blue button to verify that the connection has been set up correctly.<\/p>\n\n<p class=\"wp-block-paragraph\">An additional browser window will open. If your browser blocks it, allow it. Then sign up for registration on the provider&#8217;s site.<\/p>\n\n<p class=\"wp-block-paragraph\">Return to the details page and check the results. If the test is successful, you&#8217;ll see what types of information the provider has submitted. Personal information is not displayed in the test.<\/p>\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-Test.png\"><img decoding=\"async\" width=\"1924\" height=\"380\" src=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-Test.png\" alt=\"Test the OICD registration\" class=\"wp-image-97990\" srcset=\"https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-Test.png 1924w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-Test-300x59.png 300w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-Test-765x151.png 765w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-Test-1024x202.png 1024w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-Test-1536x303.png 1536w, https:\/\/churchtools.academy\/wp-content\/uploads\/2026\/10\/OICD-Server-Test-360x71.png 360w\" sizes=\"(max-width: 1924px) 100vw, 1924px\" \/><\/a><\/figure>\n\n<p class=\"wp-block-paragraph\">The test checks the technical connection and the validity of the registration. It does not create any individuals in ChurchTools, does not link any accounts, and does not sign up any individuals into ChurchTools. A successful test therefore does not prove that the individual mapping works.<\/p>\n\n<p class=\"wp-block-paragraph\">Therefore, check that you are actually signed up by using a separate browser profile or incognito window. Use a specific, active user and then verify that you are signed up in the correct ChurchTools profile. If you want to approve new users, it\u2019s best to check this scenario as well and review the assigned permissions.<\/p>\n\n<aside class=\"wp-block-group ct-artikel-zum-weiterlesen has-background is-layout-constrained wp-container-core-group-is-layout-79a8db7e wp-block-group-is-layout-constrained\" style=\"border-radius:8px;background-color:#f9fafb;margin-top:24px;margin-bottom:24px;padding-top:32px;padding-right:24px;padding-bottom:32px;padding-left:24px\">\n<h2 class=\"wp-block-heading has-medium-font-size\">Read more<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/churchtools.academy\/en\/help\/system-settings\/login-systemeinstellungen\/login-to-and-with-churchtools\/\" data-type=\"docs\" data-id=\"43227\">Login to and with ChurchTools<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/churchtools.academy\/de\/help\/system-einstellungen\/login-systemeinstellungen\/ueberblick-ueber-die-angebotenen-login-methoden\/\" data-type=\"link\" data-id=\"https:\/\/churchtools.academy\/de\/help\/system-einstellungen\/login-systemeinstellungen\/ueberblick-ueber-die-angebotenen-login-methoden\/\">Overview of Available Login Methods<\/a><\/li>\n<\/ul>\n<\/aside>\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Here, we&#8217;ll explain how to connect an external Login provider to your ChurchTools using OIDC. This allows your users to use their Login credentials from a third-party system\u2014such as Microsoft 365\u2014to log in to your ChurchTools. 1. Register ChurchTools with the provider Create an application for your ChurchTools system with the provider. Some providers also [&hellip;]<\/p>\n","protected":false},"author":43,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"doc_category":[739],"doc_tag":[],"knowledge_base":[425],"class_list":["post-98495","docs","type-docs","status-publish","hentry","doc_category-oauth-oidc-and-saml","knowledge_base-system-settings"],"pp_statuses_selecting_workflow":false,"pp_workflow_action":"current","pp_status_selection":"publish","pp_force_visibility":null,"pp_subpost_visibility":null,"pp_inherited_force_visibility":null,"pp_inherited_subpost_visibility":null,"acf":[],"year_month":"2026-11","word_count":605,"total_views":0,"reactions":{"happy":0,"normal":0,"sad":0},"author_info":{"name":"Stefan Krumsdorf","author_nicename":"skrumsdorf","author_url":"https:\/\/churchtools.academy\/en\/author\/skrumsdorf\/"},"doc_category_info":[{"term_name":"OAuth, OIDC, and SAML","term_url":"https:\/\/churchtools.academy\/en\/help\/non-knowledgebase\/oauth-oidc-and-saml\/"}],"doc_tag_info":[],"knowledge_base_info":[{"term_name":"System Settings","term_url":"https:\/\/churchtools.academy\/en\/help\/system-settings\/","term_slug":"system-settings"}],"knowledge_base_slug":["system-settings"],"_links":{"self":[{"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/docs\/98495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/users\/43"}],"replies":[{"embeddable":true,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/comments?post=98495"}],"version-history":[{"count":43,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/docs\/98495\/revisions"}],"predecessor-version":[{"id":98610,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/docs\/98495\/revisions\/98610"}],"wp:attachment":[{"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/media?parent=98495"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/doc_category?post=98495"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/doc_tag?post=98495"},{"taxonomy":"knowledge_base","embeddable":true,"href":"https:\/\/churchtools.academy\/en\/wp-json\/wp\/v2\/knowledge_base?post=98495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}