<a id="sso-for-c3"></a>

# Single Sign-On (SSO) for Confluent Control Center on Confluent Platform

SSO lets Control Center users authenticate once through an
identity provider instead of maintaining separate Control Center credentials.
You can enable SSO for Control Center to offload user and authentication
management to a supported OpenID Connect (OIDC) identity provider. SSO also
lets you enforce additional security controls, such as multi-factor
authentication (MFA).

After enabling SSO for Control Center, your Control Center users go to the
Control Center page and click **Log in via SSO** to sign in to Control Center
using their SSO user credentials.

Considerations:

- To enable SSO for Control Center in Confluent Platform, you must configure Control Center to
  use an OIDC identity provider.

- To use SSO with Control Center your installation must use Confluent Platform version 7.5 or later.
- SSO for Control Center does not support identity provider (IdP) refresh
  token rotation. If your IdP has this feature enabled, you must
  turn it off in your IdP settings to ensure successful token renewal.
  For more information, see
  [Refresh token rotation is not supported](troubleshoot.md#troubleshoot-sso-oidc-refresh-token-rotation).

## Configuration methods

Choose the configuration method that fits your environment:

* For manual configuration:
  * [Configure single sign-on (SSO) using OIDC](configure-sso-using-oidc.md#configure-sso-using-oidc)
  * [Configure OIDC SSO for the Confluent CLI](configure-sso-for-cli.md#configure-sso-for-cli-using-oidc)
* For automated configuration:

  Confluent recommends using Confluent Ansible and Confluent for Kubernetes (CFK) to automate
  the configuration of SSO for Control Center on Confluent Platform. For more information, see:
  * Confluent Ansible: [Configure single sign-on authentication for Control Center](https://docs.confluent.io/ansible/current/ansible-authenticate.html#ansible-c3-sso)
  * CFK: [Configure single sign-on authentication for Confluent Control Center](https://docs.confluent.io/operator/current/co-authenticate-cp.html#co-authenticate-c3-sso)

If you encounter issues enabling SSO, see [Troubleshoot SSO for Control Center using OIDC on Confluent Platform](troubleshoot.md#troubleshoot-sso-for-c3).