If your identity provider is not named in the settings, choose "Other (OpenID Connect)". The requirements below are what Tamaat checks. We have not tested providers one by one, so the connection test is your proof: it shows what your provider sends before anyone depends on it.
What your provider must offer
Register Tamaat at your provider as a web application that keeps a client secret. The provider must:
| Requirement | Detail |
|---|---|
Answer over https | Every address the provider gives must be an https address that Tamaat can reach. |
| Publish a discovery document | Tamaat reads the provider's addresses from it. It is normally found from the issuer; if yours is elsewhere, enter it under "Advanced" as "Discovery document address (optional)". |
| Use the standard sign-in for web applications | The authorization code flow, with PKCE (S256). |
| Accept a client secret | Tamaat proves itself to the provider with the client ID and client secret. |
| Sign its answers | With RS256, PS256 or ES256. |
| Send a permanent ID for each person | An ID that never changes and is never given to someone else. Tamaat recognises people by it. |
| Send the person's email address | Tamaat asks for the person's identity, name and email address, and nothing more. |
Two more things are not needed for a member's everyday sign-in, and are needed for the features named:
| If your provider also… | You can… |
|---|---|
| States when each person signed in | Let an invited person accept their invitation with your sign-in, require single sign-on, and open a published map or dashboard with your sign-in. |
| Sends each person's groups | Narrow a published map or dashboard to chosen groups. |
Set it up
Follow Set Up Single Sign-On and choose "Other (OpenID Connect)" under "Identity provider". Three things differ from a named provider:
- Groups are not assumed. If you want groups, fill in "Where your provider lists groups" yourself and choose whether "Groups are sent as" "IDs" or "Names".
- New people confirm their email once. With this choice Tamaat does not take your provider's word for an email address. A person who has no Tamaat account yet types a six-digit code that Tamaat emails them, the first time they sign in. The test result says so: "Email: people confirm with a code the first time".
- Read the test result line by line. "Permanent ID received", "Email received" and "Sign-in time received" should all be present. A line that reads "Not received" tells you what your provider is not sending.
Limits
- OpenID Connect only. SAML is not available in this release.
- Sign-in starts at Tamaat. A tile in your provider's portal works when it points at the connection's "Sign-in address".
- Groups are for published maps and dashboards only. They never set a role or a seat.
- No directory sync. Tamaat does not create or remove members from your provider.
- No sign-out at your provider. Signing out of Tamaat ends the Tamaat session only.
- Up to five connections in one organization.
- A provider on a private network cannot be reached by Tamaat's hosted service.
When a test fails, the result gives one sentence that names what to change. Troubleshoot Single Sign-On lists them all. If your provider cannot meet a requirement, the test keeps failing; there is no setting that relaxes a check.