Single Sign-On (SSO) Configuration

How to connect Microsoft Entra ID (Azure AD) — or any OIDC / SAML 2.0 identity provider — to RAIC, which endpoint belongs in which field, and how to diagnose a failed sign-in.

Before you start

SSO and SCIM are
Enterprise
features. Other plans see an upgrade prompt on the settings page.
You need the RAIC OrgAdmin role to configure SSO.
In Entra you need Global Administrator, Cloud Application Administrator, Application Administrator, or ownership of the application object.
Only one protocol can be active per organization. Enabling OIDC automatically disables SAML, and vice versa.
All values below are also shown with copy buttons in the app at Admin → SSO Settings.

Endpoints to register with your identity provider

OIDC redirect URI

https://app.rhindoncyber.com/sso/callback

SAML Reply URL (Assertion Consumer Service)

https://app.rhindoncyber.com/api/public/sso-callback

SAML Identifier (SP Entity ID / Audience URI)

https://app.rhindoncyber.com

Migration note: earlier deployments pointed the OIDC redirect URI and SAML ACS URL at a backend callback function hosted outside the application domain. That endpoint has been retired and now returns a not-found error. Any identity provider still configured with the old URL must be repointed to the values above before sign-in will work.

Microsoft Entra ID — OIDC walkthrough

For an OIDC application the redirect URI is not set under Enterprise applications → Single sign-on (that screen only manages claims). Use App registrations → Authentication, or click Go to application from the Single sign-on screen.

Sign in to portal.azure.com as a Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the application object.
Go to Microsoft Entra ID → App registrations and open your RAIC sign-in application (search by name or Application/client ID). Sign-in needs its own app registration: do not use the Microsoft discovery app from Admin → Integrations, which holds directory-wide permissions.
In the left menu select Authentication.
Under Platform configurations, open the Web platform. If none exists, choose Add a platform → Web.
Click Add URI and paste the Redirect URI below, exactly as shown — lowercase, https, no trailing slash.
Leave Implicit grant and hybrid flows unchecked. RAIC uses the authorization code flow.
Click Save.
Open API permissions and confirm the delegated permissions openid, profile and email are present with admin consent granted, and that the app has no application permissions. Test Connection on Admin → Integrations warns if it holds more.
Under Certificates & secrets, create a client secret if you do not already have one and copy the Value (not the Secret ID) into the Client Secret field on this page.

Redirect URI (Web platform)

https://app.rhindoncyber.com/sso/callback

Sign-on URL (optional)

https://app.rhindoncyber.com/login

These addresses use the configured sign-in address, even when you open this guide through a preview or alternate address. Copy the values shown above rather than the address in your browser.

If sign-in fails

AADSTS50011 — the redirect URI does not match byte-for-byte. Re-copy it from above.
AADSTS700016 — the Client ID on this page does not match the app registration in that tenant.
Invalid client secret — the secret expired or the Secret ID was pasted instead of the Value.
Changes normally apply immediately; allow up to five minutes for directory propagation.

Add the email-verification claims (required for new users)

RAIC creates an account on a person's first company sign-in only when Microsoft confirms the email address is verified. Existing members are not affected.

In the Microsoft Entra admin center, open App registrations and select your RAIC app.
Open Token configuration and choose Add optional claim.
Select token type ID, tick email, upn, xms_pdl and xms_edov, and choose Add. RAIC compares upn (the sign-in name) with email. If asked, also tick 'Turn on the Microsoft Graph email permission'.
If xms_edov is not in the list: open Manifest, set "acceptMappedClaims": true, add xms_pdl under optionalClaims.idToken, then rename that entry's name from xms_pdl to xms_edov and Save.
Ask a new user to sign in again. RAIC now accepts the first sign-in.

If these claims are missing, a person signing in for the first time sees: "Your company sign-in did not confirm this email address is verified, so a new account can't be created. Ask your administrator to add the email-verification claims" with a link to these steps. People who already have an account sign in normally.

Microsoft Entra ID — SAML 2.0 walkthrough

Go to Microsoft Entra ID → Enterprise applications and open your RAIC application.
Select Single sign-on and choose SAML. (If the app was created as OIDC-based, the SAML option is unavailable — SAML requires a separate SAML-based gallery/non-gallery application.)
Edit Basic SAML Configuration and enter the Identifier, Reply URL and Sign-on URL below. Leave Relay State blank — RAIC sets it during sign-in initiation.
Save, then open Attributes & Claims. Set the unique user identifier (Name ID) to user.mail or user.userprincipalname and confirm the emailaddress, givenname and surname claims are present.
Under SAML Certificates, copy the App Federation Metadata URL and the Base64 signing certificate into the SAML fields on this page.
Under Users and groups, assign the users or groups allowed to sign in.
Use Test single sign-on, then confirm with a real sign-in in a private window.

Identifier (Entity ID / Audience URI)

https://app.rhindoncyber.com

Reply URL (Assertion Consumer Service URL)

https://app.rhindoncyber.com/api/public/sso-callback

Sign-on URL

https://app.rhindoncyber.com/login

If sign-in fails

Reply URL mismatch — the ACS URL in Entra must match the value above exactly.
No email in assertion — set Name ID to user.mail and verify the email claim mapping.
User not assigned — add the user or group under Users and groups.
Signature validation failed — the signing certificate rotated; re-paste the current Base64 certificate.

Testing and rollout

Keep any previously registered redirect URI in place while you cut over, so a rollback is possible.
Save the configuration in RAIC and enable the protocol.
Open the RAIC login page in a private window, choose Sign in with SSO, and enter a work email matching an allowed domain.
Test with a non-admin account before rolling out organization-wide.
Check Admin → Activity Log for detailed diagnostics on any failure.
Once sign-in is confirmed, remove the obsolete redirect URI from the identity provider.

Troubleshooting

Symptom	Likely cause	Fix
AADSTS50011: redirect URI mismatch	The URI registered in Entra differs from the one RAIC sends.	Re-copy the redirect URI from Admin → SSO Settings. Match case exactly, use https, and no trailing slash.
AADSTS700016: application not found in directory	The Client ID belongs to a different tenant, or the app registration was deleted.	Confirm the Application (client) ID and the tenant in the Issuer URL both come from the same app registration.
SAML: Reply URL does not match	The Assertion Consumer Service URL in Entra is stale.	Set the Reply URL to the ACS value shown on the SSO Settings page.
First sign-in refused: email address not verified	The Entra ID token does not include the email-verification claims (email, upn, xms_pdl, xms_edov).	Follow 'Add the email-verification claims' above (Token configuration, or the Manifest workaround), then sign in again.
Sign-in succeeds but no account is created	The assertion or token carries no email claim, or the domain is outside Allowed Email Domains.	Map Name ID to user.mail (or user.userprincipalname) and add the domain to Allowed Email Domains.
User is not assigned to this application	Entra assignment is required and the user or group has not been added.	Assign the user or group under Enterprise applications → Users and groups.
Signature validation failed	The IdP signing certificate rotated.	Copy the current Base64 certificate from SAML Certificates back into the SAML configuration.
Invalid client secret	The secret expired, or the Secret ID was pasted instead of the Value.	Create a new client secret and paste the Value column. Set a reminder before the expiry date.