Follow the steps below to set up an OIDC SSO integration with o2o.

Register a new client in your OIDC Identity Provider

At the side of the identity provider, a new client (i.e., my.o2o.be) needs to be added with the following parameters:

• Authorised JavaScript origin: https://my.o2o.be
• Authorised redirect URI: https://my.o2o.be/auth/oidc/callback

Register the following claims to automatically pass user information in the id token / via the userinfo endpoint from the identity provider to o2o:

• email
• given_name
• family_name
• (optional) bike_plan_code (bedrijfslogincode) Bike plans are created during onboarding to define different leasing options for different employees. During registration, this code can be passed automatically from the IdP or can be manually entered by the employee. If all employees have the same leasing options, there is no need to provide a bike plan code.
• (optional) contract_type (statuut): allowed values are clerk (’Bediende’, white collar worker) or worker (’Arbeider’, blue collar worker)
• (optional) employee_id (personeelsnummer)
• (optional) cost_centre (kostenplaats)

Securely exchange the required parameters with o2o

Setting up a new client in your OIDC IdP will automatically generate a client ID and client secret . Send these to o2o together with the other parameters below. We suggest 1Password to securely exchange the sensitive parameters, but any other secure way is fine as well.

• Client ID The unique identifier that the IdP issues to the client application (i.e., my.o2o.be)
• Client Secret The unique code (similar to a password) that the IdP issues to the client application (i.e., my.o2o.be)
• Email domain(s) Every user that tries to login with an email address belonging to this domain will be redirected to the OIDC IdP to login
• IdP Name / Company Name We use this name to inform our users in the authentication flow (e.g. for an error message: "something went wrong while logging in via [IdP name]"
• Discovery document URL The OpenID Connect protocol requires the use of multiple endpoints for authenticating users, and for requesting resources including tokens, user information, and public keys. To simplify implementations and increase flexibility, OpenID Connect allows the use of a "Discovery document," a JSON document found at a well-known location containing key-value pairs which provide details about the OpenID Connect provider's configuration, including the URIs of the authorization, token, revocation, userinfo, and public-keys endpoints.