Choosing a protocol

RIKAISO supports SAML 2.0 and OpenID Connect. Use OpenID Connect for new deployments; use SAML where your identity provider or compliance framework requires it. Both can be active during a migration, with one marked as primary.

OpenID Connect

1. Register a confidential client in your identity provider.
2. Set the redirect URI to https://<tenant>.rikaiso.example/auth/callback, or the equivalent under your custom domain.
3. Request the scopes openid, profile, and email.
4. Enter issuer, client ID, and client secret in Administration → Identity.
5. Test with the built-in verification flow before enforcing.

SAML 2.0

Upload the identity provider metadata document, or enter the sign-in URL and signing certificate manually. RIKAISO metadata is published at /saml/metadata.

Group mapping

Map identity provider groups to RIKAISO roles in Administration → Identity → Mapping. Unmapped groups are ignored. Mapping is evaluated at sign-in and again on token refresh.

Keep at least one local break-glass administrator. If the identity provider becomes unreachable, federated sign-in is the only path back in.