Introduction

The Sublime Platform integrates with OpenID Connect (OIDC), a modern single sign-on protocol, allowing you to authenticate with Sublime via Okta, OneLogin, Azure Active Directory, or any other OIDC provider.

There are two high-level steps to integrating the Sublime Platform with OpenID Connect:

Obtain a set of OIDC settings, consisting of an issuer URL, a client ID, and a client secret
Add these settings to Sublime

1. Obtain OIDC settings

The process for obtaining OIDC settings varies between OIDC identity providers, but typically involves creating an application that includes an OAuth 2.0 client ID and client secret, and configuring the appropriate redirect URI.

Okta

Below are the steps for obtaining OIDC settings via Okta.

Open the OIDC settings modal in Sublime:

Log into the Sublime Platform
Go to Settings > Account
Under Authentication, click the button next to Open ID Connect
Keep this page open, as you'll use the Initiate login URL and Redirect URI to set up an application in Okta

Create the application in Okta:

Sign into your Okta admin console
Go to Applications > Applications
Click Create App Integration
In the modal that opens, select Sign-in method of OIDC - OpenID Connect
Then select Application type of Web Application
Click the Next button
Provide an App integration name, such as "Sublime Platform"
Optionally add a logo. You can download the Sublime logo here.
In the Grant type section, check Implicit (Hybrid)
In Sign-in redirect URIs, paste the Redirect URI from Sublime
Remove the default entry in Sign-out redirect URIs
In the Controlled access section, select your preferred option
Click the Save button
Click the Edit button in the General Settings section
In Login initiated by, select Either Okta or App
In Initiate login URI, paste the Initiate login URL from Sublime
Next to Application visibility, check Display application icon to users and optionally check Display application icon in the Okta Mobile app
Click the Save button
Note the Client ID and Client secret from the current page
Click the Sign On tab
Note the Issuer URL under OpenID Connect ID Token

You'll use the client ID, client secret, and issuer URL you noted in the next section

Azure Active Directory

To use Azure Active Directory as your SSO provider for Sublime, you'll need to create an Azure application. Note that you have the option of using the same application you created when setting up a Microsoft 365 message source.

🚧
You must use an Azure AD tenant you control
You must create your Azure application for Sublime SSO in a tenant you wholly control to ensure no third party can impersonate your users.

First, get the Redirect URI for your Sublime organization:

Log into the Sublime Platform
Go to Settings > Account
Under Authentication, click the button next to Open ID Connect
Note the Redirect URI, as you'll use it to set up an application in Azure

To create the application in Azure, follow the steps below. If you're using an existing Azure app for SSO, jump to step 7.

Sign into portal.azure.com
Click App Registrations
Click New Registration
Give your application a name, such as "Sublime Platform"
Under Supported account types select Accounts in this organizational directory only if it's not already selected by default
Click Register (skip the Redirect URI section)
In the Overview section of the application's settings, note the Application (client) ID and the Directory (tenant) ID. You'll use these IDs later.
Go to the Authentication settings page
Click Add a platform
In the panel that opens, click Web
Under Redirect URIs, paste the Redirect URI from Sublime
Under Implicit grant and hybrid flows, check ID tokens
Click Configure
Go to the Certificates & secrets settings page
Click New client secret
Give the client secret a name like "Sublime SSO" and select an expiration of "24 months"
Click Add
Note the value of the new client secret

Now that you've configure your Azure application, you'll use the following values in the next section of this guide:

Your issuer URL is https://login.microsoftonline.com/TENANT_ID/v2.0, with TENANT_ID being the Directory (tenant) ID you noted earlier
Your client ID is the Application (client) ID you noted earlier
Your client secret is the client secret you just created

Google

In order to use Google's OpenID Connect feature, you'll need to create a Google Cloud Platform project with an OAuth app restricted to your organization, then create a client ID/secret pair to use to set up OIDC in Sublime.

Here's a video recording showing the steps to configure the app and create the client ID/secret pair.

Note that the GCP settings not configured in the recording are optional.
Add the Redirect URI provided in the "Configure OpenID Connect" modal in Sublime to the "authorized redirect URIs" in GCP.
Add the client ID and client secret from Google to your OIDC settings in Sublime, using https://accounts.google.com as the "Issuer URL".

2. Add OIDC settings to Sublime

Log into the Sublime Platform
Go to Settings > Account
Under Authentication, click the button next to Open ID Connect
Enter your OIDC issuer URL, client ID, and client secret
Click the Save button

Test the integration

You should now be able to sign into Sublime with your OIDC identity provider. You can verify the integration is working by either selecting the Sublime Platform application in your provider (for example, Okta), or by loading the Initiate login URL from your OIDC settings in Sublime.

📘
Matching user required
For a user to successfully sign into Sublime with your OIDC identity provider, there must already be a matching user with the same email address in Sublime.

Managing allowed authentication methods

Once you set up OpenID Connect, you can optionally restrict user signin to only OpenID Connect. If you'd like to use this option:

Sign out of Sublime and verify signin via OpenID Connect is working
Go to Settings > Account
Under Authentication, click the button next to Allowed methods
Select Users must log in with OpenID Connect SSO
Click Save