Add External Identity Provider

Add external OIDC-compliant IDP enabling users to sign in to Raidiam Connect with their preferred authentication provider, map groups, and request approval for Just‑In‑Time (JIT) provisioning.

Prerequisites

• Organisation Admin role for the target organisation.

• Administrative access to the external IDP (to obtain Client ID and configure redirect URI).

• Ability to add TXT records to your organisation's DNS.

Add New IDP Configuration and First Version

1. Within Organisation View, select Directory > Servers > Your Server > IDP Configuration.

2. Click New IDP Configuration and complete the 5-step wizard, in this order:

   Step 1 - Config Details

   • Display Name

   • Contact Emails (comma‑separated) — used to contact your organisation about IDP issues such as unavailability or suspected malpractice.

   • Redirect URI Suffix (optional) — sets the suffix of the generated redirect URI. If left blank, a UUID is generated automatically.

   Step 2 - Config Summary

   • Review the configuration created so far and download either the Public Key or the Certificate to add to your IDP configuration before continuing.

   Step 3 - Version Info

   • Client ID from your IDP.

     In your Identity Provider, create a client application for Raidiam Connect integration. It will be used to authenticate Raidiam Connect with your IDP/authorization server using the private_key_jwt client authentication method.

   • Authentication Policies — for example TWO_FACTOR. Available values include CLICK_TO_ACCEPT_TERMS, ESIGNATURE_TERMS, RECOVERY_CODES, TWO_FACTOR, and VERIFY_EMAIL_AND_MOBILE.

   • Group Claim — the key of the claim in the IDP's ID Token that contains the user's group memberships (e.g. groups). This claim must be a JSON array of group external IDs matching the Groups configured for this SSO Configuration; unmatched values result in no permissions being assigned.

   Step 4 - Domains

   • Restricted Domains

     Restricted Domains are email domains that can only use the configured SSO Provider for authentication. Users with email addresses from these domains are required to authenticate through the external IDP.

   • Supported Domains

     Supported Domains are email domains that have the option to use the configured SSO Provider for authentication while retaining the option to use the Raidiam IDP.

   Step 5 - Advanced Configuration

   • Additional Scope Values — extra OAuth/OIDC scopes to request from the external IDP beyond the default openid profile email, needed if your Authentication Policies or claim mappings require them.

   • Group Claim Path (optional) — a JSONPath expression for extracting group membership information from the IDP token, for cases where it isn't available as a simple top-level claim. Enter only the path segment (for example, entering groups resolves to $.groups.); the wizard shows a live preview of the resolved path as you type.

Add a Version to an Existing IDP Configuration

If an IDP Configuration already exists (for example, your IDP's client credentials changed and you need a new Client ID), you can add a new version without redoing the Config Details or Config Summary steps. This uses a shorter 3-step wizard covering the same Version Info, Domains, and Advanced Configuration fields described above.

Configure IDP/Authorization Server

1. Copy the generated TXT Record Value and add it to the DNS zone of your IDP to verify ownership.

2. Add the generated redirect_uri to the External IDP configuration - this is used to redirect the user back to Raidiam after login.

3. Download the Public Key or Certificate from the wizard's Config Summary step and include it in your IDP configuration.

   This is used to validate private_key_jwt client authentication.

4. Make sure your IDP/Authorization Server:

   • Allows the private_key_jwt client authentication method.

   • Allows the client to request the openid profile email scopes (plus any Additional Scope Values configured in the wizard).

   • Returns the profile and groups claims (or whichever claim key or path you configured in Group Claim and, if used, Group Claim Path) within ID tokens.

   • Allows the client to request the phone and email scope if you assigned Authentication Policies that forces the user to authenticate using OTP (MFA).

Get IDP Version Approved

Once you save an IDP Version, it enters the Pending Approval status.

1. Notify a Super User to approve the version.

   After the Super User has approved the version and the Configuration was bound to a group, it can be used for SSO.

2. Once your IDP version is approved, select the three dots next to it and change it to the Active status.

3. Perform a test login via the external IDP and confirm a successful authentication.

Field Reference

This section explains each field involved in setting up your external IDP and why it's required.

SSO Configuration

Field	Purpose
Display Name	A human-readable label to identify the IDP in the UI during the login. This name is displayed on the login button when the email contains one of the associated domains
Contact Emails	One or more email addresses (comma-separated) of the team responsible for managing the IDP. Used for operational alerts or domain control issues.
Redirect URI Suffix	Optional suffix for the generated redirect URI. If left blank, a UUID is generated automatically.
TXT Record Value	A DNS record value generated by the Directory to validate that your organisation owns the specified email domains. This must be added to your DNS to enable domain-restricted SSO - You won't be able to create a version while this is not done.
Redirect URI	The callback URL the external IDP uses to return users to the Directory after successful authentication. This must be whitelisted in the IDP's application settings.
Public Key / Certificate	The corresponding public key or certificate to the private key used to sign the token request by the directory. Used by the IDP to validate the request signature. Either can be downloaded from the wizard's Config Summary step.

SSO Configuration Version

Field	Purpose
Client ID	The identifier issued by your IDP for the Directory as a relying party. Used during the OAuth/OIDC flow to initiate authentication.
Authentication Policies	Optional flags that request additional login requirements at the IDP (e.g. TWO_FACTOR, VERIFY_EMAIL_AND_MOBILE). These help enforce stronger authentication at login. Some of them may be mandatory by the administrators, and versions may be refused if the mandatory policies are not included
Restricted Domains	Email domains that must use this IDP for login. Users with these domains are blocked from using the default Raidiam login - with email and password.
Supported Domains	Domains allowed to use this IDP for login, but may also use Raidiam IDP if no restriction exists. Cannot include wildcards.
Group Claim	The key of the claim in the IDP's ID Token that contains the user's group memberships (e.g. groups). Must be a JSON array of group external IDs matching the Groups configured for this SSO Configuration. Unmatched values result in no permissions being assigned.
Group Claim Path (optional, Advanced Configuration)	A JSONPath expression for extracting group membership information from the IDP token, for cases where it isn't available as a simple top-level claim. Enter only the path segment (e.g. entering groups resolves to $.groups.; entering user_groups resolves to $.user_groups.). The wizard shows a live preview of the resolved path.
Additional Scope Values	Extra OAuth/OIDC scopes, beyond openid profile email, to request from the IDP during authentication - configured in the wizard's Advanced Configuration step.