Custom OpenID Connect

Some identity providers do not have a dedicated option in the SSO setup wizard. For those providers, select OpenID Connect and enter the connection details yourself.

This topic covers the OpenID Connect settings only. For the shared wizard steps, see SSO setup.

This documentation contains references to third-party software, or technologies. While efforts are made to keep third-party references updated, the images, documentation, or guidance in this topic may not accurately represent the current behavior or user interfaces of the third-party software. For more considerations regarding third-party software, such as copyright and ownership, see Terms of Use.

When to use OpenID Connect

Select OpenID Connect in the Provider Type step when both of the following are true:

Your identity provider supports the OpenID Connect (OIDC) protocol.
Your identity provider does not have its own option in the Provider Type step.

Identity providers that commonly use this option include Duo, Keycloak, and PingFederate.

Some identity providers support both OpenID Connect and SAML 2.0. Select the protocol your provider is configured for. For SAML 2.0, see Custom SAML 2.0.

Before you begin

Complete these items before you start the wizard:

Create an OIDC application for Relativity in your identity provider.
Confirm you have administrator access to your identity provider.
Review the prerequisites in Prerequisites.

Open your identity provider in a separate browser window while you work through the wizard. You move values between the two systems.

OpenID Connect settings in Relativity

Enter the configuration details from your identity provider on the Configure SSO Provider screen.

OpenID Connect configuration step of the SSO setup wizard

All of these fields are required:

Provider Name—enter a name for the connection. The login page shows this name on the SSO button.
Issuer URL—enter the issuer from your identity provider.
Client ID—enter the client ID from the application you created for Relativity.
Client Secret—enter the client secret from that application.
Authorization Endpoint—enter the authorization endpoint from your identity provider.
Token Endpoint—enter the token endpoint from your identity provider.
JWKS URI—enter the JSON Web Key Set (JWKS) URI from your identity provider.

Many identity providers display the client secret only once. Copy and store it when you create the application.

Getting the values from your identity provider

Collect these values in your identity provider before you start the wizard. Field labels differ by provider, so check your provider's documentation for the equivalent name.

The client ID and client secret from your OIDC application.
The issuer.
The authorization endpoint, the token endpoint, and the JWKS URI.

Many identity providers publish the issuer, the endpoints, and the JWKS URI together at their OpenID configuration endpoint.

For the steps to create the application and locate these values, see your identity provider's documentation.

Testing and enabling the provider

After you enter the settings, the wizard generates a callback URL. Add it to your identity provider, then test the connection.

For these shared steps, see Registering an SSO provider.