Configuring an IDP for the Tenant

Configuring the IDP within the Platform needs to be done at the Tenant level.

Connecting to an Internal or External IDP at the Tenant Level

At the Tenant level, you can either use the Internal PlainID Identity Provider, or you can configure the Platform to access your Identity Provider by selecting to use an External IDP on the Tenant.

When you enable an External IDP, you can then enable multiple users from your organization to access the Platform.

With the PlainID Internal IDP, a single user is designated as the Admin with all rights. With an External IDP configured for the Tenant, individual users can be assigned Permissions, enabling them to be either an Editor (edit/view rights) or a Viewer (view only rights).

By default, the PlainID Internal IDP source is used, and this is displayed when the default IDP source has not been changed.

To configure the IDP Source:

1. Click the Tenant settings icon

• The Tenant IDP Settings screen opens.

2. The current IDP Source is displayed. To change the IDP Source, click Edit.
3. Select either PlainID Internal or External IDP.

If you select External IDP, you'll need to configure some of the parameters as explained below.

Configuring an External IDP

Configuring an External IDP for the Tenant involves configuring the IDP side (a configuration that needs to be done on the vendor IDP—for example Okta, ForgeRock, Auth0, etc.) as well as within the Platform.

Once you configure an External IDP, you will be able to add users as either Editors or Viewers based on the Permissions you apply at the Tenant level.

Requirements to Configure an External IDP

To configure an External IDP, you must provide the IDP Metadata URI from your IDP configuration. With this, you can either import the remaining IDP general settings required to use your IDP with the Platform, or you can manually enter the following OpenID Connect configuration requirements taken from your IDP source configuration as detailed in the steps below.

Configuring an External IDP at the Tenant Level

1. Select Tenant Settings in the left navigation bar.

2. Click Tenant IDP Settings. The Select IDP Source screen opens.

3. Click Edit. The fields become editable and the External IDP option appears.

4. Select External IDP. Additional sections appear.

5. In the General Details section, find the Redirect URI. Click Copy to copy this information and save it for when you configure your organization's IDP to work with the Platform.

6. Enter a Display Name for the IDP.

7. In the IDP Application Settings section, enter the Client ID and Client Secret from your identity source.

8. In the Client Authentication field, choose how the Client ID and Client Secret are sent to the IDP. Options include:

   • Client Secret sent as JWT
   • Client Secret sent as basic auth
   • Client Secret sent as POST
   • JWT signed as private key

9. In the IDP General Settings section, enter the IDP Metadata URI.

10. In the same IDP General Settings section, set the User Identifier Claim. This is the claim your IDP sends to identify the user. The Platform uses this claim to determine what appears in the User field of Admin Audit records.

    • This field defaults to email and is editable.
    • The new mapping only takes effect on each user's next login. Until a user logs in again, their token still carries the previous claim (email).
    • Changing the User Identifier doesn't rewrite previous audit records. Audit records already written with a claim like email keep that value; only entries created after a user's next login show the new claim.

11. Alternatively, you can define the OpenID Connect Configuration settings, including the:

    • Authorization URL
    • Token URL (required)
    • Logout URL
    • JWKS URL (required)
    • Issuer (required)
    • Scopes (required)
      • The field is auto-populated with the OpenID email profile. You can either keep this field as is, or add or remove the content.

12. In the Tenant Authorization Settings section, enter the Claim and Claim Value. The Claim and Claim Value let you define who will have Admin rights in the Tenant. This claim needs to be included in the ID token passed to the Platform from the IDP.

    *Note: Configure your IDP to include only the claims necessary for PlainID internal permission evaluation in the JWT.

13. In the Tenant Notification Settings section, enter the Email Claim Name. This is the claim your IDP sends that the Platform uses to resolve a user's email address for notifications, in cases where the login claim isn't an email (for example, when a user authenticates with a UPN instead of an email).

    • The Tenant Notification Settings section only appears for Tenants using an External IDP. Tenants using the Platform Internal IDP don't see this section.
    • The new mapping only takes effect on each user's next login. Until a user logs in again, the Platform can't resolve their email from the new claim.
    • If the configured claim is missing from the IDP token, or its value is empty or not a valid email format, the Platform can't resolve the user's email. The user still receives in-app notifications, but email notifications stay disabled until a valid email is resolved.

14. Click Save.