Skip to main content
This guide refers to using SSO to authenticate access to your endpoints. You cannot use these instructions to set up SSO for logging into your ngrok account in the dashboard.
This guide explains how to configure miniOrange as the primary Identity Provider for ngrok endpoints using single sign-on (SSO). By integrating miniOrange SSO with ngrok, you can:
  • Restrict access to your ngrok endpoints to only users authenticated via miniOrange
  • Use miniOrange security policies and multi-factor authentication (MFA) authenticators
  • Use miniOrange’s dashboard to facilitate access to ngrok apps
The ngrok integration with miniOrange supports service provider-initiated (SP-initiated) SSO. In this mode, users access ngrok endpoints and are redirected to miniOrange for authentication.

​
What you’ll need

  • A miniOrange account with administrative rights to create apps.
  • An ngrok Pay-as-you-go account with an authtoken or admin access to configure endpoints with OpenID Connect.
1

Configure miniOrange

Add an OAuth2/OpenID Connect application in miniOrange by following miniOrange’s guide to adding an OAuth app. When you configure the application, enter https://idp.ngrok.com/oauth2/callback as the Redirect-URL.After you save the application, copy the following values, which you use when you configure ngrok:
  • Client ID and Client Secret from the application’s edit page.
  • The Discovery Endpoint URL from the application’s OAuth Endpoints page. Use this URL as the issuer URL in the next step, without the /.well-known/openid-configuration suffix (for example, https://login.xecurify.com/moas/discovery/v2.0/abcd1234).
Create at least one miniOrange user and grant it access to the application so that user can sign in through miniOrange.
2

Configure ngrok

Use the OpenID Connect Traffic Policy action to enforce miniOrange authentication on your endpoint.
This step assumes you have an app running locally (for example, on localhost:3000) with the ngrok client installed.
Create a policy.yaml file with the following content, replacing the placeholder values with those copied from miniOrange:
Start an ngrok endpoint with this policy, replacing YOUR_DOMAIN with your ngrok domain:
Copy the URL next to Forwarding (for example, https://miniorange-sso-test.ngrok.app).
3

Test the integration

  • In your browser, launch an incognito window.
  • Access your ngrok endpoint using the copied endpoint URL (for example, https://miniorange-sso-test.ngrok.app).
  • When prompted, log in with your miniOrange credentials.
  • After you log in, you see your web app.