# Authentication
## Overview
On the Authentication page, user access is set up to the server. Three types of authentication are supported:
1. Built-in authentication (username + password)
2. SAML SSO
3. Google OpenID Connect (OIDC) / Google OAuth2
### Built-in authentication
Built-in authentication is enabled by default. In this configuration, a new user can only sign up to the VPC via the signup links provided by the admins. This allows admin control over who can sign up to the Code Ocean VPC.
### SAML SSO and Google OpenID Connect (OIDC)
These two authentication methods allow an admin to use the client's existing identity provider to simplify sign-in to Code Ocean.
When configuring Google OIDC or SAML SSO, an admin can disable the built-in authentication method to require signups through the client's own identity provider This is considered a security best practice.
An admin can allow built-in authentication when using an identity provider to enable logins for users outside the client's company domain.
Code Ocean VPC supports Identity Provider (IdP) initiated SAML SSO. This allows an admin to add Code Ocean as an application in their organization portal for quick discovery and access by users.
## Create New Configuration Authentication
### Step 1: Choose your preferred authentication method
In the Admin Panel, you can view the three options with the Built-in authentication checked as the default option.
Select SAML SSO and OIDC to open the configuration form.
{% hint style="info" %}
Once you choose SAML SSO or OIDC, the configuration form will appear with the steps for you to follow.
{% endhint %}
### Step 2: Enable built-in authentication in addition to this provider.
You can decide if you want to enable the built-in authentication or not.
### Step 3: SAML Assertion Consumer Service URL / OAuth2 callback URL
The information you need to provide to the identity provider’s configuration pages is indicated in the following step:
You can copy the value.
{% tabs %}
{% tab title="SAML SSO" %}
You need to provide:
* ACS URL
* Entity ID
{% endtab %}
{% tab title="Google OAuth2" %}
You need to provide:
* Authorized Javascript origins
* Authorized Redirect URIs
**Configuring google OAuth2**
1\. Go to [Google Cloud Platform](https://console.cloud.google.com/apis/credentials?project=private-cloud-deployment\&pli=1) and click the **Create Credentials** button
2\. Choose OAuth client ID
3\. Under application type select **Web application**
4\. Provide `Authorized Javascript` origins and `Authorized Redirect URIs`
* Under “Authorized javascript origins” click the “ADD URI” button
* Under “Authorized redirect URIs” click the “ADD URI” button
5\. Click the **Create** button at the bottom of the page
{% endtab %}
{% endtabs %}
### Step 4: Provide the following information from your identity provider
You will find the values to fill in step 4 on the identity provider’s configuration pages.
{% tabs %}
{% tab title="SAML SSO" %}
You need to find the following field on the identity provider's configuration pages:
* Single Sign-on URL
* Entity ID
* x.509 Certificate
{% endtab %}
{% tab title="Google OAuth2" %}
After the OAuth2 is created. Copy the text from `Your Client ID` and `Your Client Secret` textboxes to their respective fields (Client ID and Client Secret) in the admin dashboard step 4.
{% endtab %}
{% endtabs %}
### Enable the Configuration
Once all the steps are complete, click **Enable** at the bottom of the form to set the new Authentication method.
## Switching Configuration Authentication
When you enter the Authentication page, the current authentication method is checked. To switch to a different method, select that method to bring up the configuration form.
Click **Enable** at the bottom of the form to change the authentication setting.
{% hint style="info" %}
If that method is not configured, follow the above steps to set up the configuration.
If the method is configured, some fields will not display the values for security reasons. for example OpenID's Client Secret.
{% endhint %}
{% hint style="warning" %}
To switch back to Built-in authentication and disable the other two methods. Click **Built-in authentication** on Step1, then click **Enable Built-in Authentication** on step 2.
This will clear the existing configuration and reset it to the default built-in authentication method.
{% endhint %}
