Sign in with OpenID Connect

Use generic OpenID Connect (OIDC) when your enterprise identity provider supports OIDC discovery and authorization-code sign-in. OpenRUM can configure multiple providers, each with a distinct provider ID and login button. It verifies the signed ID token, issuer, audience, expiry, nonce, and verified email.

Before starting, deploy OpenRUM at its canonical HTTPS PUBLIC_BASE_URL, sign in as Instance Owner, and enable encrypted secret storage. The API service must be able to reach the provider’s HTTPS discovery and token endpoints.

1. Register an OIDC client

   In your identity provider, create a confidential web client for the authorization-code flow. Allow the openid, profile, and email scopes, and make sure the ID token includes sub, email, and email_verified: true for permitted users. Choose a provider ID such as company-sso, then register this exact redirect URI:

   https://rum.example.com/api/v1/auth/providers/company-sso/callback

   Replace the domain with your PUBLIC_BASE_URL host and the path segment with your provider ID. Copy the Client ID and Client Secret. Obtain the provider’s exact HTTPS Issuer URL from its OIDC discovery document; enter the issuer, not the discovery document URL.

2. Configure and test OpenRUM

   Open System Settings → Authentication, select Generic OIDC, and enter a unique provider ID, display name, Client ID, Issuer URL, and Client Secret. Save with Enable and show on login unchecked, reverify with the Owner’s OpenRUM password, then select Test connection. Complete the provider authorization. The test returns to settings without creating an account.

3. Enable and sign in

   Check Enable and show on login and save. In a separate browser session, choose the provider’s display name on the login page. A new external account needs an Organization role. Existing users should link this provider in Account before using it to sign in.

Keep provider identities stable

Provider IDs and their identity directories are not interchangeable. If you change the Issuer URL or Client ID, create a new provider ID and let users link the new identity from Account. Existing identity links remain recorded when a provider is disabled.

The OpenID Connect Discovery specification describes issuer metadata and discovery requirements.

Other sign-in methods