Configure OpenID Connect

OpenID Connect lets users sign in to webmate with the identity provider your organization already uses.

webmate supports OpenID Connect based single sign-on workflows, including Authorization Code Flow and Implicit Flow. SAML based sign-on can also be supported through identity brokers. Because sign-on configuration affects every user in your organization, the setup is coordinated with webmate support.

Before You Start

Prepare the following information before requesting the configuration:

The identity provider that should be connected to webmate.
The OpenID Connect issuer URL or discovery endpoint.
The client ID for the webmate application registration.
The client secret, if your selected flow requires one.
The scopes and claims your identity provider returns for user identity, especially email address and name.
The list of users or domains that should be allowed to sign in with single sign-on.

Keep at least one organization administrator account with password-based access until single sign-on has been tested successfully. This gives your organization a fallback if the identity provider configuration changes or becomes unavailable.

Register webmate in Your Identity Provider

Create an application registration for webmate in your identity provider. Use the redirect URL and other values provided by webmate support for your organization. The exact values can depend on your webmate instance and sign-on flow.

For most providers, the registration should allow the standard OpenID Connect scopes openid, profile, and email. The email claim should contain the same email address that identifies the user account in webmate.

Request the webmate Configuration

Contact webmate support (opens in a new tab) and provide the prepared OpenID Connect information. webmate support will configure the single sign-on setting for your organization and coordinate any required test login.

The related setting is listed in the webmate settings reference under Single Sign-On.

Test the Login Flow

After support confirms that the configuration is active, test the sign-in flow with a small group of users before relying on it for the whole organization.

Verify that:

Existing users can sign in with the identity provider.
The email address returned by the identity provider matches the webmate user account.
New or invited users understand which sign-in method they should use.
Organization administrators can still reach the administration area.

If a user cannot sign in, check whether the identity provider returns the expected email claim and whether the user exists in webmate. If an administrator account is locked, follow the instructions in Unlock User Account .

Maintain the Configuration

Single sign-on depends on both the webmate configuration and the identity provider registration. Contact webmate support before rotating client secrets, changing redirect URLs, replacing identity providers, or disabling the application registration in your provider.

When you change the identity provider configuration, run another test login with an administrator account and a regular user account before treating the change as complete.