Product · Connect your customers
OpenID Connect (OIDC)
Connect an OIDC identity provider from its discovery URL
Give RealmSSO the discovery URL of your customer’s OpenID Connect IdP. RealmSSO reads the endpoints and sets up the connection. You set up OIDC in the dashboard or the API. Your customer’s IT admin cannot do it from the Admin Portal screen today.
- Customer’s IdPOIDC, from a discovery URL
- code exchange
- Customer’s realmdoes the code exchange
- identity claims, in a signed token
- Your application(s)simply check each token
- RealmSSO APInot on the sign-in path; secret encrypted in its DB
Create a connection
You create an OIDC connection in the dashboard or the API. Your customer’s IT admin cannot do it from the Admin Portal screen, because its OIDC tab does not work today.
Discovery URL
Give the discovery URL of the customer’s IdP. RealmSSO reads the endpoints from it and sets up the connection in the account’s realm. A realm is the separate sign-in space RealmSSO makes for each account. Creation fails if the document has no authorization endpoint or no token endpoint. You reach this through the API and the dashboard.
Client secret
RealmSSO encrypts the OIDC client secret at rest in its database and never returns it in a response. The sign-in service keeps its own working copy of the secret.
Redirect URI
The redirect URI your customer registers belongs to the sign-in service. The sign-in service does the code exchange with the IdP. RealmSSO’s API is not on the login path. The API and the dashboard show the URI for each connection.
After you create it, and the limits
These rows cover stored tokens, testing, editing and what we have not tested.
Provider tokens are stored
The sign-in service stores the tokens that your customer’s IdP issues. This is automatic.
Connection check
A check reads the IdP’s discovery document again and compares the issuer. It never performs a login. Connection health runs on demand. There is no scheduled check. You run it from the API or the dashboard.
A new issuer resets users’ links
A save that keeps the provider’s issuer updates the connection’s identity provider configuration in place and keeps every user’s link. A save that changes the issuer replaces the configuration and drops every user’s link to it. A returning user cannot link again by themselves.
Standard OIDC providers
RealmSSO is built to the OpenID Connect standard. Not yet tested against Entra ID, Okta, ADFS or Google.
Talk to the people who build it.
We run RealmSSO for you. Tell us which identity providers your customers use and how many customers you have, and we will tell you what fits today.