Skip to main content
Ignite must register your connection before OIDC sign-in can be tested. Ignite uses the OIDC authorization code flow with PKCE enabled by default. For the documented secret-based setup, register a confidential web client. Start with SSO setup for the sandbox and production URLs and the providerId assigned to your connection.

Connection handoff

Exchange these details for each environment. You can create the IdP client to obtain its client ID first. Wait for Ignite’s exact redirect URI and settings before completing its registration.

You provide Ignite

  • OIDC as the protocol and the target environment (sandbox or production).
  • IdP issuer and discovery URL, and the client ID assigned to Ignite for this environment.
  • Client secret through an agreed secure channel.
  • Proposed mapping for the user’s email claim, including whether it comes from the ID token or UserInfo.
  • The scopes your IdP requires to release that claim.
  • IdP test identities for sign-in and access testing.

Ignite confirms before you complete IdP registration

  • The connection’s providerId, confirmed browser launch URL, and exact OIDC redirect URI.
  • The token endpoint client authentication method for this connection: client_secret_basic or client_secret_post.
  • The exact scopes Ignite will request, including openid and any scopes needed for the agreed email claim.
  • Whether PKCE is enabled for this connection.
  • The agreed email mapping, mapped test identities and invitations, and that this environment is ready for testing.
The client authentication method specifies how Ignite sends its client ID and secret when exchanging an authorization code at your IdP’s token endpoint: client_secret_basic uses an HTTP Basic authorization header. client_secret_post sends them in the request body. Configure the IdP client to accept the method Ignite confirms.

Identity claims

Ignite reads UserInfo when configured, otherwise the ID token. When UserInfo is used, its sub must match the ID token’s sub. First sign-in also depends on Ignite account and invitation access. A valid IdP response alone does not grant access.