SSO: OpenID Connect

This document is an onboarding guide for OpenID Connect SSO with Reviewpro. It assumes that the reader has an understanding of OAuth and specifically OpenID Connect protocols.

Introduction

OpenID Connect is an identity layer built on the well-established OAuth 2.0 protocol. It is a modern alternative to SAML, solving many of the protocol's known problems. Many of the designers of OpenID Connect originally built the SAML protocol.

By integrating OpenID Connect, we facilitate a seamless Single Sign-On (SSO) experience that eliminates the need for multiple credentials. This feature allows enterprise clients to centralize user authentication within their existing identity management infrastructure.

Security is enhanced by ensuring that sensitive passwords never leave the organization's secure environment. Administrators benefit from automated user provisioning and instant access revocation across all connected corporate services.

Requirements

1. Understanding of the OAuth and OpenID Connect protocols
2. Use an identity service that supports OpenID Connect. Some examples include Microsoft Azure (AD FS), Microsoft Entra ID (formerly Azure AD), Google Identity Service and Okta.
3. Have administrative access to your identity service.

Part 1: Identity Provider Setup

On your identity provider, you will need to create an application. Please make sure that: 

1. The openid scope is enabled, along with the scope(s) needed to expose the email and/or UPN (User Principal Name) claims you plan to use for matching (see Part 2: Attribute and Claim Mapping)
2. The authorized redirect URIs contains an entry for https://app.reviewpro.com/openid/auth

The application creation will create the following values:

• clientId
• clientSecret
• accessTokenUri
• userAuthUri
• userInfo
• jwksUri
• iss
• redirectUri

Part 2: Attribute and Claim Mapping for IdP Configuration

This section defines the user information that your IdP sends to Reviewpro, and how Reviewpro uses it to identify the correct user account. Reviewpro supports two claims for matching an SSO user to a Reviewpro account: email and UPN (User Principal Name). Ensure at least one of these is correctly mapped and sent by your IdP.

• Email claim: Your user's email address on the identity provider must match that user's email address in Reviewpro.

• UPN claim: Your user's UPN (User Principal Name) on the identity provider must match that user's username in Reviewpro.

User Matching & Authentication Flow

When a user authenticates via OpenID Connect, this is how our system will work:

1) FINDING THE USER

- The Email or User Principal Name(UPN) are received from the IdP, one of them must match a user in Reviewpro. If a match is found, we proceed to the authentication step.

2) AUTHENTICATION

- The Email entered on the Reviewpro login page must match either the Reviewpro email or the Reviewpro Username. If this validation is successful, the user is authenticated

Part 3: Reviewpro Reputation Configuration

 - Once you configure your IdP with OpenID Connect please contact Reviewpro Customer Success Team and provide the required information below:

• clientId
• clientSecret
• Client Secret expiry date
• accessTokenUri
• userAuthUri
• userInfo
• jwksUri
• iss
• redirectUri

- Reviewpro will create the SSO profile and confirm to the client that it is ready for testing with one user.

- To test, open the Reviewpro platform and login with your user, once logged in, navigate into settings > Organization > Users 

 - Search for the user, enter edit mode, mark the option "SSO required”, select the "yes”, select the right profile and save.

- Test the login via your Single sign on.

If you would prefer to use SAML for your SSO integration instead, see related article here: SSO: SAML.