Skip to main content

Connect a Generic OIDC Provider

note

SSO connectors are available on the enterprise plan and use OpenID Connect (OIDC).

Viostream can integrate with any identity provider that supports the OpenID Connect (OIDC) standard. If your provider isn't Microsoft Entra ID, Okta, or Ping Identity, use the generic instructions below — the concepts and field names are the same across providers, even if the exact navigation in your provider's admin console differs.

How a viewer signs in via your identity provider once the connector is set up
note

Authorization for Channel SSO happens entirely in your identity provider. Grant the users who should have access to this application, and they'll be automatically authorized to view the Channel as soon as they can sign in — Viostream doesn't apply any further access controls on top of this.

For provider-specific guides, see:

If you get stuck, consult your identity provider's documentation or contact Customer Success via the Live Chat.

Step 1: Create an OIDC application​

In your identity provider, create a new OIDC or OpenID Connect application (this may also be called a "Web application" or "App integration", depending on the provider).

For the Redirect URI (sometimes called Callback URL), enter:

https://id.app.viostream.com/oauth2/callback

Step 2: Add the required scopes​

Ensure the following scopes (sometimes called "claims") are enabled for the application:

  • openid
  • profile
  • email

Most providers include these by default. If your provider allows optional claims, ensure name and email are included, or note down what they're called so Customer Success can help map them.

Step 3: Generate credentials​

Generate a Client ID and Client Secret for the application. These should not be shared except when entering them into Viostream in Step 4.

Locate the provider's Issuer URL (sometimes found in an .well-known/openid-configuration metadata document, or listed directly on the application's configuration page).

Step 4: Add the provider in Viostream​

  1. Navigate to Connectors in the  Settings page.
  2. Click Connect on the SSO provider card under Single Sign-On.
  3. Enter your Issuer URL, Client ID, Client Secret and the Email Domain you wish to associate with this provider (e.g. viostream.com).
  4. Click Save.

Your provider is now available to use with your Channels and other features as they become available.

Rotate your Client Secret​

Client secrets should be rotated periodically, or immediately if you suspect a secret has been exposed.

  1. In your identity provider, generate a new Client Secret for the application (most providers let you do this without immediately invalidating the existing one).
  2. In Viostream, navigate to Connectors in the  Settings page, open the connected provider card, and update the Client Secret field with the new value, then click Save.
  3. Once you've confirmed sign-in still works with the new secret, return to your identity provider and remove the old one.

See also​