Single Sign-On (SSO) Configuration

How to connect Microsoft Entra ID (Azure AD) — or any OIDC / SAML 2.0 identity provider — to RAIC, which endpoint belongs in which field, and how to diagnose a failed sign-in.

Before you start

SSO and SCIM are
Enterprise
features. Other plans see an upgrade prompt on the settings page.
You need the RAIC OrgAdmin role to configure SSO.
In Entra you need Global Administrator, Cloud Application Administrator, Application Administrator, or ownership of the application object.
Only one protocol can be active per organization. Enabling OIDC automatically disables SAML, and vice versa.
All values below are also shown with copy buttons in the app at Admin → SSO Settings.

Endpoints to register with your identity provider

OIDC redirect URI

https://app.rhindoncyber.com/sso/callback

SAML Reply URL (Assertion Consumer Service)

https://app.rhindoncyber.com/api/public/sso-callback

SAML Identifier (SP Entity ID / Audience URI)

https://app.rhindoncyber.com

Migration note: earlier deployments pointed the OIDC redirect URI and SAML ACS URL at a backend callback function hosted outside the application domain. That endpoint has been retired and now returns a not-found error. Any identity provider still configured with the old URL must be repointed to the values above before sign-in will work.

Microsoft Entra ID — OIDC walkthrough

For an OIDC application the redirect URI is not set under Enterprise applications → Single sign-on (that screen only manages claims). Use App registrations → Authentication, or click Go to application from the Single sign-on screen.

Sign in to portal.azure.com as a Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the application object.
Go to Microsoft Entra ID → App registrations and open your RAIC application (search by name or Application/client ID).
In the left menu select Authentication.
Under Platform configurations, open the Web platform. If none exists, choose Add a platform → Web.
Click Add URI and paste the Redirect URI below, exactly as shown — lowercase, https, no trailing slash.
Leave Implicit grant and hybrid flows unchecked. RAIC uses the authorization code flow.
Click Save.
Open API permissions and confirm the delegated permissions openid, profile and email are present with admin consent granted.
Under Certificates & secrets, create a client secret if you do not already have one and copy the Value (not the Secret ID) into the Client Secret field on this page.

Redirect URI (Web platform)

https://app.rhindoncyber.com/sso/callback

Sign-on URL (optional)

https://app.rhindoncyber.com/login

If sign-in fails

AADSTS50011 — the redirect URI does not match byte-for-byte. Re-copy it from above.
AADSTS700016 — the Client ID on this page does not match the app registration in that tenant.
Invalid client secret — the secret expired or the Secret ID was pasted instead of the Value.
Changes normally apply immediately; allow up to five minutes for directory propagation.

Microsoft Entra ID — SAML 2.0 walkthrough

Go to Microsoft Entra ID → Enterprise applications and open your RAIC application.
Select Single sign-on and choose SAML. (If the app was created as OIDC-based, the SAML option is unavailable — SAML requires a separate SAML-based gallery/non-gallery application.)
Edit Basic SAML Configuration and enter the Identifier, Reply URL and Sign-on URL below. Leave Relay State blank — RAIC sets it during sign-in initiation.
Save, then open Attributes & Claims. Set the unique user identifier (Name ID) to user.mail or user.userprincipalname and confirm the emailaddress, givenname and surname claims are present.
Under SAML Certificates, copy the App Federation Metadata URL and the Base64 signing certificate into the SAML fields on this page.
Under Users and groups, assign the users or groups allowed to sign in.
Use Test single sign-on, then confirm with a real sign-in in a private window.

Identifier (Entity ID / Audience URI)

https://app.rhindoncyber.com

Reply URL (Assertion Consumer Service URL)

https://app.rhindoncyber.com/api/public/sso-callback

Sign-on URL

https://app.rhindoncyber.com/login

If sign-in fails

Reply URL mismatch — the ACS URL in Entra must match the value above exactly.
No email in assertion — set Name ID to user.mail and verify the email claim mapping.
User not assigned — add the user or group under Users and groups.
Signature validation failed — the signing certificate rotated; re-paste the current Base64 certificate.

Testing and rollout

Keep any previously registered redirect URI in place while you cut over, so a rollback is possible.
Save the configuration in RAIC and enable the protocol.
Open the RAIC login page in a private window, choose Sign in with SSO, and enter a work email matching an allowed domain.
Test with a non-admin account before rolling out organization-wide.
Check Admin → Activity Log for detailed diagnostics on any failure.
Once sign-in is confirmed, remove the obsolete redirect URI from the identity provider.

Troubleshooting

Symptom	Likely cause	Fix
AADSTS50011: redirect URI mismatch	The URI registered in Entra differs from the one RAIC sends.	Re-copy the redirect URI from Admin → SSO Settings. Match case exactly, use https, and no trailing slash.
AADSTS700016: application not found in directory	The Client ID belongs to a different tenant, or the app registration was deleted.	Confirm the Application (client) ID and the tenant in the Issuer URL both come from the same app registration.
SAML: Reply URL does not match	The Assertion Consumer Service URL in Entra is stale.	Set the Reply URL to the ACS value shown on the SSO Settings page.
Sign-in succeeds but no account is created	The assertion or token carries no email claim, or the domain is outside Allowed Email Domains.	Map Name ID to user.mail (or user.userprincipalname) and add the domain to Allowed Email Domains.
User is not assigned to this application	Entra assignment is required and the user or group has not been added.	Assign the user or group under Enterprise applications → Users and groups.
Signature validation failed	The IdP signing certificate rotated.	Copy the current Base64 certificate from SAML Certificates back into the SAML configuration.
Invalid client secret	The secret expired, or the Secret ID was pasted instead of the Value.	Create a new client secret and paste the Value column. Set a reminder before the expiry date.