Document version
| Version |
Date |
Auteur |
Description |
| v1.0 |
05/04/2024 |
Florent Martinier |
Initial document |
| v1.1 |
03/09/2026 |
Gautier Levert |
Add requested scopes and expected claims |
| v1.2 |
03/09/2026 |
Gautier Levert |
Add redirect URI, client type and secret expiry |
To connect your SSO to our authentication system, we support the OpenID Connect protocol.
Configuration on your side
Create a confidential application using the Authorization Code flow. A public client or a single-page application does not work: we authenticate with a client secret.
<aside>
💡
Wait for Sopht to provide the redirect URI before configuring it in your application. This information is unique to each configuration.
</aside>
Information to provide to Sopht
We require the following information :
- Authorization URL
- Endpoint defined in the OpenID Connect protocol
- ex :
https://auth.example.com/aaaa/oauth2/v2.0/authorize
- Token URL
- Endpoint defined in the OpenID Connect protocol
- ex :
https://auth.example.com/aaaa/oauth2/v2.0/token
- Logout URL
- Endpoint used to logout a user from the platform
- ex :
https://auth.example.com/aaaa/oauth2/v2.0/logout
- User Info URL
- Endpoint defined in the OpenID Connect protocol, returns user profile info
- ex :
https://auth.example.com/oidc/userinfo
- Issuer
- Token issuer, used to validate the token origin
- ex :
https://auth.example.com/aaaa/v2.0
- JWKS URL
- URL where identity provider keys in JWK format are stored.
- ex :
https://auth.example.com/aaaa/discovery/v2.0/keys
- Client ID
- ID of the application created in your SSO
- Client Secret
- Secret of the application created in your SSO
- Also tell us its expiry date. Renew it with us before that date: an expired secret stops every login for your organisation.
- Email domains
- List of all domains on which your SSO has addresses
- ex :
aaaa.com, aaaa.fr, aaaa-it.com
- It is also possible to authorize all the sub-domains of a domain on demand; by default, this behavior is disabled.
- PKCE
- Some SSO require PKCE (Proof of Key-Code Exchange). In that case, we need the PKCE method.
- Available methods :
none, plain, S256
- Requested scopes
- We request
openid profile email on the authorization endpoint.
openid marks the request as OpenID Connect, profile carries the names, email carries the address.- The application must be allowed to request all three. Most providers grant them by default, some require an explicit configuration.
Expected claims