[Yandex Cloud documentation](../../../../index.md) > [Yandex Identity Hub](../../../index.md) > [Tutorials](../../index.md) > [Setting up single sign-on (SSO) for apps](../index.md) > Time > OpenID Connect

# Creating an OIDC app in Yandex Identity Hub for integration with Time

[Time](https://time-messenger.ru/) is a corporate messenger with single sign-on support based on the [OpenID Connect](https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)) (OIDC) standard.

For your [organization's](../../../concepts/organization.md) users to be able to authenticate to Time via OpenID Connect SSO, create an [OIDC app](../../../concepts/applications/oidc.md) in Yandex Identity Hub and configure it both in Yandex Identity Hub and Time.

OIDC apps can be managed by users with the `organization-manager.oauthApplications.admin` [role](../../../security/index.md#organization-manager-oauthApplications-admin) or higher.

To provide your organization's with access to Time:

1. [Create an app](#create-app).
1. [Set up the integration](#setup-integration).
1. [Add users](#add-users).
1. [Make sure the application works correctly](#validate).

## Create an app {#create-app}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps**.
    1. In the top-right corner, click ![Circles3Plus](../../../../_assets/console-icons/circles-3-plus.svg) **Create application** and in the window that opens:
        1. Select the **OIDC (OpenID Connect)** single sign-on method.
        1. In the **Application type** field, select [Web Application](*web_app_type).
           
           [*web_app_type]: OIDC apps of the `Web Application` type are optimized for user authentication to external web apps with a server end (backend), where the application secret can be safely stored. For more information about OIDC application types, see [Types of OIDC apps in Yandex Identity Hub](../../../concepts/applications/oidc.md#oidc-application-types).
        1. In the **Name** field, specify a name for your new app: `time-oidc-app`.
        1. In the **Folder** field, select the folder where you want to create an OAuth client for your app.
        1. Optionally, add a description and [labels](../../../../resource-manager/concepts/labels.md) for the app.
        1. Click **Create application**.

{% endlist %}

## Set up the integration {#setup-integration}

To configure Time integration with the OIDC app you created in Yandex Identity Hub, complete the configuration both on the Yandex Identity Hub side and in Time.

### Get the application's credentials and create a secret for it {#get-credentials-secret}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, click ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and select =`time-oidc-app`.
    1. On the **Overview** tab, under **Identity provider (IdP) configuration**, copy the **ClientID** setting value.
    1. Create an app secret (only available for applications of the `Web Application` [type](../../../concepts/applications/oidc.md#oidc-application-types)):
       
       1. Under **App secrets**, click **Add secret**, and in the window that opens:
       
           1. Optionally, add a description for the new secret.
           1. Click **Create**.
       
       The window will display the generated [application secret](../../../concepts/applications/oidc.md#oidc-secret). Save this value.
       
       {% note warning %}
       
       If you refresh or close the application information page, you will not be able to view the secret again.
       
       {% endnote %}
       
       If you closed or refreshed the page before saving the secret, click **Add secret** to create a new one.
       
       To delete a secret, in the list of secrets on the OIDC app page, click ![ellipsis](../../../../_assets/console-icons/ellipsis.svg) in the secret row and select ![trash-bin](../../../../_assets/console-icons/trash-bin.svg) **Delete**.

{% endlist %}

### Set up OIDC authentication in Time {#setup-sp}

1. Log in to the Time system console at `https://<instance_name>.time-messenger.ru/admin_console/authentication/openid`, where `<instance_name>` is the name of your Time instance.
1. Under **Authentication**:
   1. Select **OpenID Connect**.
   1. Under **Select provider**, select **OpenID connection (Other)**.
   1. Optionally, in the **Button name** field, enter the text that appears on the login button on the login page, e.g., `Via OIDC`.
   1. Optionally, select a color for the login page button.
   1. In the **Issuer link** field, enter the OpenID Connect provider's address: `https://auth.yandex.cloud`.
   1. In the **Client ID** field, enter the **ClientID** value you copied from Yandex Identity Hub.
   1. In the **Client key** field, specify the application secret generated in Yandex Identity Hub.
1. Save the settings.

### Configure a redirect URI in Yandex Identity Hub {#setup-redirect}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, click ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and select `time-oidc-app`.
    1. At the top right, click ![pencil](../../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:
        1. In the **Redirect URI** field, specify this callback address: `https://<instance_name>.time-messenger.ru/signup/openid/complete`, where `<instance_name>` is the name of the Time instance (subdomain at `time-messenger.ru`).
        1. Under **OAuth/OIDC security**, disable the **Require PKCE** option so that Yandex Identity Hub does not require the external application to use the [PKCE](*pkce_info) security extension when exchanging data.
           
           [*pkce_info]: PKCE is a security extension used in OAuth 2.0 to minimize the risk of authentication data interception. For more information, see [PKCE](../../../concepts/applications/oidc.md#pkce).
        1. Click **Save**.

{% endlist %}

## Add users {#add-users}

To authenticate with Time, add the required users and/or [user groups](../../../concepts/groups.md) to your Yandex Identity Hub OIDC application.

{% note info %}

Users and groups added to an OIDC application can be managed by any user with the `organization-manager.oidcApplications.userAdmin` [role](../../../security/index.md#organization-manager-oidcApplications-userAdmin) or higher.

{% endnote %}

To add users to a SAML application:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, click ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and select `time-oidc-app`.
    1. Navigate to the **Users and groups** tab.
    1. Click ![person-plus](../../../../_assets/console-icons/person-plus.svg) **Add users**.
    1. In the window that opens, select the required users.
    1. Click **Add**.

{% endlist %}

{% note tip %}

If you want to fine-tune user authentication in your applications, including authentication only from specific IP addresses, use [authentication policies](*authentication_policies).

{% endnote %}

[*authentication_policies]: Authentication policies are a Yandex Identity Hub tool that allows you to flexibly configure access to applications by denying or allowing authentication for specific users in specific applications and/or from specific IP addresses. For more information, see [Authentication policies in Yandex Identity Hub](../../../concepts/authentication-policy.md).

## Make sure your application works correctly {#validate}

To ensure that your OIDC application and integration with Time are working correctly, log in to Time as one of the added users. Proceed as follows:

1. In your browser, open the login page of your Time instance: `https://<instance_name>.time-messenger.ru`.
1. Select login via OpenID Connect.
1. Authenticate in Yandex Cloud under a user account from your organization.
1. Make sure you have signed in to Time following a successful authentication.