Skip to main content

​
What Empiric Intelligence expects from your IdP

  • An issuer that serves standard OIDC discovery at {issuer}/.well-known/openid-configuration.
  • An authorization-code client. Empiric Intelligence always uses PKCE and validates the ID token’s nonce; the flow is server-side, so a confidential client with a secret is expected.
  • ID-token claims: email (required), given_name and family_name (used when provisioning).

​
Setup

1

Register the client in your IdP

Create a web (confidential) OIDC client. Set the redirect URI to:
Grant the standard openid, email, and profile scopes. Note the issuer URL, client ID, and client secret.
2

Create the connection in Empiric Intelligence

In the workspace console open Workspace, then Security, choose OIDC, and enter the issuer, client ID, and client secret. Saving requires a recent re-authentication.
3

Enable, then test

Set the connection to enabled; this needs at least one verified domain. Then open the connection’s start URL in a fresh browser session and sign in through your IdP with an email on one of your verified domains. Enforcement stays a separate step: continue to enforcement when you are ready.

​
Rotating the client secret

The stored secret is write-only: it is never displayed again after saving. To rotate it, create the new secret at your IdP and paste it into the security page; leaving the field untouched keeps the current value. Submitting an empty secret is rejected rather than silently clearing it.
As with SAML, changing the issuer, client ID, or client secret on an enforced connection automatically drops enforcement in the same save. Verify a sign-in against the new configuration, then re-enforce.