This guide explains how to integrate any OpenID Connect (OIDC) compatible application with Fixiam as the OpenID Provider (OP).

After completing this guide, users will be able to authenticate to their application using their Fixiam credentials through Single Sign On (SSO).

Prerequisites

Before you begin, ensure you have the following:

Access Requirements

Administrator access to Fixiam.
Administrator access to the application you are integrating.

Information Required from the Application

Obtain the following information from your application's OIDC documentation or administrator:

Redirect URI (Callback URL)
Logout Redirect URI (if supported)
Supported Grant Type
Supported Response Type
Required Scopes
Required User Claims

OIDC Integration Overview

The integration consists of the following steps:

Create a Custom OIDC Application in Fixiam.
Configure the OIDC client.
Configure attribute mapping.
Save the application.
Configure the application using the Fixiam OIDC details.
Grant users access to the application.
Test the integration.

Step 1: Create a Custom Application

Sign in to the Fixiam Admin Portal.
Navigate to Applications.
Click Create Application.
Select Custom Application.
Enter an application name.
Optionally upload an application logo.
Select OIDC / OAuth 2.0 as the authentication protocol.
Click Next.

Select **OIDC / OAuth 2.0** as the authentication protocol.

Step 2: Configure the OIDC Settings

Complete the required configuration fields.

Client ID

Enter a unique identifier for the application.

The Client ID identifies your application when communicating with Fixiam.

Example

my-company-app

Redirect URL

Enter the callback URL where users should be redirected after successfully signing in.

This URL must exactly match the Redirect URI configured in your application.

Example

https://app.company.com/callback

Allowed Logout URLs

Specify one or more URLs where users should be redirected after signing out.

This field is optional but recommended.

Example

https://app.company.com/logout

Access Token Expiry (In Hours)

Specify how long Access Tokens remain valid.

A shorter duration improves security, while a longer duration reduces the need for frequent reauthentication.

Recommended Value

1 Hour

Refresh Token Expiry (In Days)

Specify how long Refresh Tokens remain valid.

Refresh Tokens allow applications to obtain new Access Tokens without requiring users to sign in again.

Recommended Value

30 Days

Subject

Select the user attribute that uniquely identifies each user.

The selected value will be included as the sub claim in the ID Token.

Common options include:

Email Address
Username
Employee ID

Choose a value that uniquely identifies users within your organization.

Client Credential Grant

Enable this option if your application requires machine-to-machine authentication using the OAuth 2.0 Client Credentials Grant.

Leave this option disabled for applications that authenticate interactive users.

Step 3: Configure Attribute Mapping

Attribute Mapping determines which user information Fixiam returns to your application after successful authentication.

Map the required claims based on your application's requirements.

A typical configuration is shown below.

OIDC Claim	Fixiam Attribute
email	mail
given_name	givenName
family_name	surname
preferred_username	userName
name	displayName

Note

Some applications require additional claims. Refer to your application's documentation to determine the required claims.

Step 4: Configure the Login Flow

Configure how users should access the application through Fixiam.

Review the available login flow options and configure them according to your organization's requirements.

Screenshot: Login Flow

Step 5: Save the Application

Review your configuration and click Save.

Saving the application registers the OIDC client in Fixiam.

Step 6: Configure Your Application

After saving the application in Fixiam, complete the OIDC configuration in your application's administration portal.

Depending on your application, configure it using the OIDC values generated by Fixiam.

These values may include:

Issuer URL
Discovery Endpoint
Client ID
Client Secret
Authorization Endpoint
Token Endpoint
UserInfo Endpoint
JWKS Endpoint

Some applications support importing the Discovery Endpoint automatically, while others require these values to be entered manually.

Important

The integration is only complete after both Fixiam and your application have been configured successfully.

Step 7: Grant Users Access

Configuring OIDC establishes trust between Fixiam and your application.

Users must also be granted access before they can successfully authenticate.

Create a Group

Navigate to Groups.
Click Create Group.
Enter a group name.
Save the group.

Assign the Application

Open the group.
Navigate to the Applications tab.
Click Assign Application.
Select the OIDC application.
Save your changes.

Add a Test User

Navigate to the Members tab.
Click Add Member.
Select a test user.
Save your changes.

Note

Only users who belong to a group with the assigned application can access the application through Single Sign On.

Step 8: Test the Integration

Sign in as the test user.
Open the application.
You should be redirected to Fixiam.
Authenticate using your Fixiam credentials.
After successful authentication, you should be redirected back to your application.
Confirm that the user can successfully access the application.

Verification Checklist

Before considering the integration complete, verify the following:

Troubleshooting

Invalid Redirect URI

Verify that the Redirect URL configured in Fixiam exactly matches the callback URL configured in your application.

Invalid Client

Verify that the Client ID configured in your application matches the Client ID configured in Fixiam.

Missing User Information

Review the Attribute Mapping configuration and ensure the required claims are mapped correctly.

User Cannot Access the Application

Verify that:

The application has been assigned to a group.
The user belongs to the assigned group.
The application configuration has been completed in both Fixiam and the application.

Need Help?

If you experience issues during configuration:

Verify all OIDC configuration values.
Confirm the Redirect URL is correct.
Review the configured attribute mappings.
Ensure the application has been assigned to a group.
Verify the test user has been granted access.

If the issue persists, contact your Fixiam administrator or support team for assistance.