Configuring other identity providers
Published 07 July 2023
Any Identity Provider (IdP) which implements OpenID Connect (OIDC) and supports Proof Key for Code Exchange (PKCE) can be used in conjunction with Redgate's single sign-on (SSO).
To configure SSO:
- Visit ssoadmin.red-gate.com and progress to the screen allowing you to enter the details of your IdP.
- Add a new client (some IdPs call these applications) to your IdP. Ensure it's set to use the OIDC code flow.
- Enter your chosen or generated
client_idin to ssoadmin.red-gate.com as well the IdP's URL. - Use the Test Configuration button to attempt a login via your IdP, this does not yet activate SSO.
- If the test succeeds you are given the option to activate SSO with the provided configuration.
Redgate's IdP will make an OIDC request to your IdP with:
| Parameter | Value |
|---|---|
client_id | You or your IdP choose a value then provide it to us via ssoadmin.red-gate.com |
response_type | "code" |
redirect_uri | "https://identityprovider.red-gate.com/singlesignon/signin-oidc" |
scope | "openid email" |
login_hint | The email address the user entered |
response_mode | "form_post" |
| These will have values for PKCE avoiding the need for a |
The domain of your IdP does not need to match the email domain you are configuring to use SSO.
Our IdP must be able to request the OIDC well known document from your IdP via /.well-known/openid-configuration and must be able to make requests to the URLs advertised within. No CORS headers are required.
Our IdP only requires an id_token from your IdP and only uses these claims:
| Claim | Required? | Behavior |
|---|---|---|
sub | Yes | The user will login as the Redgate ID that has this value as its external ID, if one exists. |
email | Yes | Must have the same domain as the user entered. If a Redgate ID is found using Otherwise the user will be logged in as the Redgate ID with the matching login email if one exists, and that Redgate ID has its external ID set to the value of Otherwise a new Redgate ID will be created using the |
email_verified | No | If present this must be "true". |
Our IdP will never request a logout from your IdP.
