We will create two applications:
The first application “Riot Admin” will allow administrators to connect to https://hub.tryriot.com. This application should only be assigned to Riot administrators.
The second application “Riot Employee Portal” will allow all employees to connect to their personal employee portal at https://portal.tryriot.com. This application can be assigned to all OneLogin users.
❶ Configuring the Riot Admin application
Connect to your OneLogin Admin Console, and in the top menu, go to Applications > Applications.
Click on the button “Add App”.
In the search bar, search for “OpenID Connect”
Click on the search result named “OpenId Connect (OIDC)”.
On the next page enter “Riot Admin” in the “Display Name” field, and make sure the option “Visible in portal” is enabled.
Click “Save”. The application is now created and can be configured.
In the left menu, go to Configuration.
In Login URL, enter the login URL displayed on Riot.
In Redirect URIs enter https://api.tryriot.com/v2/hub/connect/oidc/callback
Click “Save”.
Go to “SSO” now.
On this page, you can retrieve the two values you will need to enter on the Riot platform: the Client ID and the Client Secret.
Copy the values of these fields and paste them in the corresponding fields on Riot.
Change the “Token Endpoint > Authentication Method” option to “POST” and click “Save”.
Go to “Access” now.
Here you can configure who will have access to the Riot application. In this example, we have previously created a dedicated role “Riot Administrators” and assigned users to the role.
Click “Save” after selecting the roles you want to have access to the Riot Admin application.
The first application is now created, and should appear on the User Portal for the users who are members of the role which was assigned.
❷ Configuring the Riot Employee Portal application
Connect to your OneLogin Admin Console, and in the top menu, go to Applications > Applications.
Click on the button “Add App”.
In the search bar, search for “OpenID connect”
Click on the search result named “OpenId Connect (OIDC)”.
On the next page enter “Riot Employee Portal” in the “Display Name” field, and make sure the option “Visible in portal” is enabled.
Click “Save”.
The application is now created and can be configured.
In the left menu, go to Configuration.
In Login URL, enter the login URL displayed on Riot.
In Redirect URIs enter https://albert.tryriot.com/portal/auth/oidc/callback .
Click “Save”.
Go to “SSO” now.
On this page, you can retrieve the two values you will need to enter on the Riot platform: the Client ID and the Client Secret.
Copy the values of these fields and paste them in the corresponding fields on Riot.
Change the “Token Endpoint > Authentication Method” option to “POST” and click “Save”.
Go to “Access” now.
Here you can configure who will have access to the Riot application. In this example, we have previously created a dedicated role “Riot Administrators” and assigned users to the role.
Click “Save” after selecting the roles you want to have access to the Riot Admin application.
The second application is now created, and should appear on the User Portal for the users who are members of the role which was assigned.
❸ Setting an OIDC client at organization level
If you manage several Riot workspaces within the same organization, you do not have to repeat this configuration workspace by workspace.
An OIDC client can be set at organization level. The rule is as follows:
if an OIDC client is configured on the workspace, that one is used;
if no client is configured on the workspace, Riot automatically falls back to the organization's OIDC client, for administrators and employees alike.
This lets you declare your applications once, while keeping the option to override the configuration on a specific workspace.
👍 Good to know: the steps to create the applications in OneLogin described above remain identical. Only the place where you enter the Issuer, Client ID and Client Secret in Riot changes.