Skip to main content
Rima must register your connection before OIDC sign-in can be tested. Rima uses the OIDC authorization code flow with PKCE enabled by default. Start with SSO setup for the Sandbox and production URLs and the providerId assigned to your connection.

​
Exchange registration details

  1. Give Rima your IdP issuer and discovery URL, plus the client ID assigned to Rima. Exchange any client secret through an agreed secure channel.
  2. Use the client authentication method Rima supplies for your connection: client_secret_basic, client_secret_post, or private_key_jwt. For private_key_jwt, coordinate the signing key and public-key registration with Rima.
  3. Rima registers the connection and gives you its providerId and exact redirect URI. Add that URI to the matching Sandbox or production IdP registration.
  4. Open the browser launch URL supplied by Rima and test with mapped identities after the connection is confirmed as ready.

​
Identity claims

Rima reads UserInfo when configured, otherwise the ID token. When UserInfo is used, its sub must match the ID token’s sub. First sign-in also depends on Rima account and invitation access; a valid IdP response alone does not grant access.