Other identity providers

Intric connects to any identity provider that speaks OpenID Connect (OIDC) — Okta, Google Workspace, Keycloak, ADFS, and others. The steps below are the generic version of the Entra ID walkthrough; the menu names will differ in your provider’s console, but the shape of the configuration is the same.

Running Intric on your own servers

The redirect URI below is for Intric’s hosted login service, login.intric.ai. If your installation runs its own identity provider, use your own login host instead, with the same /idps/callback path — check the Callback URL shown on your IdP’s configuration page.

What to configure

• Register Intric as a confidential (server-side / Web) client, not a public or single-page-app client — Intric exchanges the authorization code server-side and needs a client secret.

• Use the authorization code flow.

• Add this redirect/callback URI:

  https://login.intric.ai/idps/callback

• Request the scopes openid, profile, email — plus whatever your provider needs to expose group membership in the token, if you’re using groups.

Not every provider can put groups in the token. Google Workspace, for example, doesn’t include group membership in its sign-in token, so group-based access isn’t available with Google out of the box. Talk to us before you plan around groups with such a provider.

What to send us

• Issuer URL (the OIDC discovery issuer, for example https://your-tenant.okta.com/oauth2/default)
• Client ID
• Client secret — the value, and its expiry date if it has one

Send these through a secure channel agreed with Intric support, never by plain email.

Required claims

• email — must be a real, verified email address. This is how Intric links a login to an Intric account.
• groups — if you’re using group-based access to Spaces, a flat list of strings, for example ["group-1", "group-2"]. Nested structures aren’t supported; see User groups for the format and its rules.

SAML 2.0

SAML 2.0 is possible, but setup is done together with Intric rather than from this page alone, because it needs attribute mapping agreed on both sides. Contact Intric support, and have ready:

• Your IdP’s metadata URL or metadata XML
• Which SAML attribute carries the user’s email address
• Which SAML attribute carries group membership, if you’re using groups

Everything else on this page — what the email claim is used for, how groups work and their limitations — applies the same way to a SAML connection.