How to set up Single sign-on (SSO)
Introduction
The Sublime Platform integrates with OpenID Connect (OIDC), a modern single sign-on protocol, allowing you to authenticate with Sublime via Okta, OneLogin, Azure Active Directory, or any other OIDC provider.
There are two high-level steps to integrating the Sublime Platform with OpenID Connect:
- Obtain a set of OIDC settings, consisting of an issuer URL, a client ID, and a client secret
- Add these settings to Sublime
1. Obtain OIDC settings
The process for obtaining OIDC settings varies between OIDC identity providers, but typically involves creating an application that includes an OAuth 2.0 client ID and client secret, and configuring the appropriate redirect URI.
Okta
Below are the steps for obtaining OIDC settings via Okta.
Open the OIDC settings modal in Sublime:
- Log into the Sublime Platform
- Go to Settings > Account
- Under Authentication, click the button next to Open ID Connect
- Keep this page open, as you'll use the Initiate login URL and Redirect URI to set up an application in Okta
Create the application in Okta:
- Sign into your Okta admin console
- Go to Applications > Applications
- Click Create App Integration
- In the modal that opens, select Sign-in method of OIDC - OpenID Connect
- Then select Application type of Web Application
- Click the Next button
- Provide an App integration name, such as "Sublime Platform"
- Optionally add a logo. You can download the Sublime logo here.
- In the Grant type section, check Implicit (Hybrid)
- In Sign-in redirect URIs, paste the Redirect URI from Sublime
- Remove the default entry in Sign-out redirect URIs
- In the Controlled access section, select your preferred option
- Click the Save button
- Click the Edit button in the General Settings section
- In Login initiated by, select Either Okta or App
- In Initiate login URI, paste the Initiate login URL from Sublime
- Next to Application visibility, check Display application icon to users and optionally check Display application icon in the Okta Mobile app
- Click the Save button
- Note the Client ID and Client secret from the current page
- Click the Sign On tab
- Note the Issuer URL under OpenID Connect ID Token
You'll use the client ID, client secret, and issuer URL you noted in the next section
Azure Active Directory
To use Azure Active Directory as your SSO provider for Sublime, you'll need to create an Azure application. Note that you have the option of using the same application you created when setting up a Microsoft 365 message source.
You must use an Azure AD tenant you control
You must create your Azure application for Sublime SSO in a tenant you wholly control to ensure no third party can impersonate your users.
First, get the Redirect URI for your Sublime organization:
- Log into the Sublime Platform
- Go to Settings > Account
- Under Authentication, click the button next to Open ID Connect
- Note the Redirect URI, as you'll use it to set up an application in Azure
To create the application in Azure, follow the steps below. If you're using an existing Azure app for SSO, jump to step 7.
- Sign into portal.azure.com
- Click App Registrations
- Click New Registration
- Give your application a name, such as "Sublime Platform"
- Under Supported account types select Accounts in this organizational directory only if it's not already selected by default
- Click Register (skip the Redirect URI section)
- In the Overview section of the application's settings, note the Application (client) ID and the Directory (tenant) ID. You'll use these IDs later.
- Go to the Authentication settings page
- Click Add a platform
- In the panel that opens, click Web
- Under Redirect URIs, paste the Redirect URI from Sublime
- Under Implicit grant and hybrid flows, check ID tokens
- Click Configure
- Go to the Certificates & secrets settings page
- Click New client secret
- Give the client secret a name like "Sublime SSO" and select an expiration of "24 months"
- Click Add
- Note the value of the new client secret
Now that you've configure your Azure application, you'll use the following values in the next section of this guide:
- Your issuer URL is
https://login.microsoftonline.com/TENANT_ID/v2.0
, withTENANT_ID
being the Directory (tenant) ID you noted earlier - Your client ID is the Application (client) ID you noted earlier
- Your client secret is the client secret you just created
Google
In order to use Google's OpenID Connect feature, you'll need to create a Google Cloud Platform project with an OAuth app restricted to your organization, then create a client ID/secret pair to use to set up OIDC in Sublime.
Here's a video recording showing the steps to configure the app and create the client ID/secret pair.
- Note that the GCP settings not configured in the recording are optional.
- Add the Redirect URI provided in the "Configure OpenID Connect" modal in Sublime to the "authorized redirect URIs" in GCP.
- Add the client ID and client secret from Google to your OIDC settings in Sublime, using
https://accounts.google.com
as the "Issuer URL".
2. Add OIDC settings to Sublime
- Log into the Sublime Platform
- Go to Settings > Account
- Under Authentication, click the button next to Open ID Connect
- Enter your OIDC issuer URL, client ID, and client secret
- Click the Save button
Test the integration
You should now be able to sign into Sublime with your OIDC identity provider. You can verify the integration is working by either selecting the Sublime Platform application in your provider (for example, Okta), or by loading the Initiate login URL from your OIDC settings in Sublime.
Matching user required
For a user to successfully sign into Sublime with your OIDC identity provider, there must already be a matching user with the same email address in Sublime.
Managing allowed authentication methods
Once you set up OpenID Connect, you can optionally restrict user signin to only OpenID Connect. If you'd like to use this option:
- Sign out of Sublime and verify signin via OpenID Connect is working
- Go to Settings > Account
- Under Authentication, click the button next to Allowed methods
- Select Users must log in with OpenID Connect SSO
- Click Save
Updated about 1 month ago