OIDC Identity providers screen

Integrations > Security > Inbound SSO > OIDC Identity Providers

An identity provider (IdP) is an external system that companies use to host and authenticates user account information for Single sign-on (SSO). The Identity Providers screen configures IdPs for single sign-on. See Configure OIDC single sign-on SSO for details about using this screen to create an IdP configuration.

Properties

IdP Name: (required) Name of this IdP to present on the sign-in page and in the configuration list of IdPs.
Logo: Image for this IdP to show on the sign-in screen. The image size must be 200px wide by 88px tall. When there is no image for the IdP, the sign-in screen shows the IdP Name and a generic image.
Description: Description of this IdP configuration for documentation purposes. This text does NOT appear on the sign-in screen.
Active: Whether or not the IdP is available to users at sign-in.
Client ID: Client ID used to connect to the OIDC IdP.
Client Secret: Client secret used to connect to the OIDC IdP.

OpenID Provider Metadata

Properties of the OpenID provider.

Tip: If the IdP supports "connect discovery", use the Discovery endpoint option to fill-in the rest of the provider metadata.

Discovery endpoint: URL to the IdP discovery endpoint. When the IdP support connection discovery, enter the IdP's discovery endpoint here, tic on the Fetch OpenID metadata from discovery endpoint options, and click Save. The remainder of the options in this section will automatically be filled in based on the information supplied by the provider. For specification information about discovery endpoints, see https://openid.net/specs/openid-connect-discovery-1_0.html.
Fetch OpenID metadata from discovery endpoint: Initiate new or updated provider metadata when clicking Save. The rest of the options in this section only update, either from a new discovery or from an update, when this option is on. Otherwise, the do not automatically update from the discovery endpoint.
Issuer: URL to the IdP issuer.
JWKeyUrl: URL to request the IdP's public key. Medallia Experience Cloud uses the key to verify the signature on the JWT ID token.
Authorization Endpoint: URL to perform OAuth authentication request of the user, and to provide the user with authorization.
Token Endpoint: URL to request an ID token from the OIDC server The token authenticates the user and includes information about the users, which can be used to create and/or identify the user's Experience Cloud account.
UserInfo Endpoint: (optional) URL to the IdP UserInfo endpoint. By default, the ID token contains an value that uniquely identifies the user account. Some IdPs provide this and additional information from a separate endpoint.
Email scope: Whether or not to request the user account's email (when it is available).
Profile scope: Whether or not to request the user account's profile, such as name, first, and last (when it is available).

Parameters

These properties configure how to process the information in the assertion from the IdP.

Auto Importer

(optional) Auto Importer specification to create and optionally update sign-on user's account. An import specification is required when the SSO event can create a user's account.

Set this to None when the IdP response contains the account's unique Username or Company ID of an existing account.

For detailed information see Create and verify SSO accounts with Auto Importer.

Claim name to map user

Claim name in the ID token that identifies the existing user account by matching the account's Username or Company Account ID. Leave this empty when using an Auto Importer specification.

Find by username

Use the OIDC claim name as the Username instead of the Company account identifier when searching for an Account.

Restriction: This property must be set when Auto Importer property is set to none.

Warning: Failure to properly set this property can generate this error message:

AutoImporter failed because automatic updates are disabled for the user, and lookup was unable to find the account.

This error can also happen when a User account is blocked form allowing file uploads to update user settings. See Users.

Advanced

The properties customize the IdP configuration.

Display Order: Order this IdP appears on the sign-in screen relative to other IdPs. Lower values appear higher on the list. When multiple IdP configurations have the same Display Order value, the IdPs appear in the order they were defined.
Seconds of clock drift to allow: Seconds before or after the assertion timestamp that the assertion is considered valid. Default is 10 (seconds). Use this property to account for clock-drift between the IdP and SP host machines.

Automatic selection

These properties define when to automatically use this IdP instead of redirecting you to the IdP select screen, where all the available IdPs are shown, letting you choose the IdP to use. For example, though a company might have multiple identity providers, these options can force all mobile device users to use just one specific IdP, while users on desktop devices might see a selection.

When more than one IdP have the automatic selection set:

When two or more IdPs have automatic selection for mobile devices and the request is from a mobile device, Experience Cloud shows the IdP with the highest display order.
When two or more IdPs have HTTP header selection criteria and it matches the request criteria, Experience Cloud shows the IdP with the highest display order.
When there is an IdP with automatic selection and one without automatic selection, Experience Cloud does not show the one without automatic selection.
When there is an IdP with automatic selection and this IdP has allow-listed IP addresses, the request must match both to be used in automatic redirection.
When you select automatic selection for mobile devices, Experience Cloud ignores the HTTP header selection criteria.
When one or more IdP have HTTP header selection criteria and it does not match the request criteria, Experience Cloud shows the IdP without defined criteria.

Automatically select this IdP for mobile devices

Use this IdP for Medallia Mobile, Medallia Voices users, and for users accessing Medallia Web reporting via a mobile device. When this option is on, the HTTP Header selection criteria for all users accessing Medallia Web reporting is set to User-Agent=.*Mobi.* to detect mobile requests.

Note: When using a browser on a mobile device, almost all browsers include a User-Agent HTTP header that includes the string "Mobi" somewhere in the field value. As such, when this option is on, all users on mobile devices will only use this IdP configuration.

HTTP Header selection criteria

Use this IdP for users accessing Medallia Web reporting based on some criteria found in the HTTP header sent by the user's browser. The format is HeaderName=RegEx-pattern. For example, when the browser is set to request English language information, it includes a header like this:

Accept-Language: en-US,en;q=0.9

To route all "English language" request to the IdP, use this expression to catch all values that start with "en":

Accept-Language=^en*

This property is ignored when Automatically select this IdP for mobile devices is on.