---
title: "Single Sign-On"
description: "Configuring SAML 2.0 or OpenID Connect for a RIKAISO tenant."
source: "https://help.rikaiso.com/2026.1/single-sign-on"
version: "2026.1"
latest: true
language: "en"
section: "Integration > Integration Guide"
updated: "2026-09-01"
---

# Single Sign-On

> Configuring SAML 2.0 or OpenID Connect for a RIKAISO tenant.

## Choosing a protocol

RIKAISO supports SAML 2.0 and OpenID Connect. Use OpenID Connect for new deployments; use SAML where your identity provider or compliance framework requires it. Both can be active during a migration, with one marked as primary.

## OpenID Connect

1. Register a confidential client in your identity provider.
2. Set the redirect URI to `https://<tenant>.rikaiso.example/auth/callback`, or the equivalent under your custom domain.
3. Request the scopes `openid`, `profile`, and `email`.
4. Enter issuer, client ID, and client secret in **Administration → Identity**.
5. Test with the built-in verification flow before enforcing.

## SAML 2.0

Upload the identity provider metadata document, or enter the sign-in URL and signing certificate manually. RIKAISO metadata is published at `/saml/metadata`.

| Attribute | Required | Example |
| --- | --- | --- |
| `NameID` | Yes | `alex@contoso.example` |
| `email` | Yes | `alex@contoso.example` |
| `displayName` | No | `Alex Moreno` |
| `groups` | No | `rikaiso-editors` |

## Group mapping

Map identity provider groups to RIKAISO roles in **Administration → Identity → Mapping**. Unmapped groups are ignored. Mapping is evaluated at sign-in and again on token refresh.

> Keep at least one local break-glass administrator. If the identity provider becomes unreachable, federated sign-in is the only path back in.