We will create two applications:
The first application āRiot Adminā will allow administrators to connect to https://hub.tryriot.com. This application should only be assigned to Riot administrators.
The second application āRiot Employee Portalā will allow all employees to connect to their personal employee portal at https://portal.tryriot.com. This application can be assigned to all JumpCloud users.
ā¶ Configuring the Riot Admin application
Connect to your JumpCloud Admin Console, and in the left menu, go to User Authentication > SSO Applications.
Click on the button āAdd New Applicationā.
In the search bar, search for āOIDCā
Click on the search result named āCustom OIDC Appā.
Click āNextā.
Enter āRiot Adminā for the āDisplay Labelā field, and make sure the option āShow the application in User Portalā is enabled.
Click āNextā.
Click āConfigure Applicationā.
Enter https://api.tryriot.com/v2/hub/connect/oidc/callback in the Redirect URIs.
Select āClient Secret Postā for the āClient Authentication Typeā option.
In the āLogin URLā field, enter the login URL that is being displayed on Riot.
In āAttribute Mappingā, select the two standard scopes: āEmailā and āProfileā.
Click āActivateā.
On this page, you can retrieve the two values you will need to enter on the Riot platform: the Client ID and the Client Secret.
Copy the values of these fields and paste them in the corresponding fields on Riot.
Your app is now created. Use the left menu to go to User Authentication > SSO Application, and click on the application āRiot Adminā, and go to the āSSOā tab.
In the āAttribute Mappingā section, it is possible that the JumpCloud console may have created duplicated entries for some fields. In our example, it duplicated āemailā and āemail_verifiedā.
Make sure you have removed any duplicated entries and click āSaveā.
Go to the āUser Groupsā tab.
Check the box next to the group of person that should be allowed to connect to the Riot Administration, and click āSaveā.
The first application is now created, and should appear on the User Portal for the persons who are members of the group which was assigned.
ā· Configuring the Riot Employee Portal application
Connect to your JumpCloud Admin Console, and in the left menu, go to User Authentication > SSO Applications.
Click on the button āAdd New Applicationā.
In the search bar, search for āOIDCā
Click on the search result named āCustom OIDC Appā.
Click āNextā.
Enter āRiot Employee Portalā for the āDisplay Labelā field, and make sure the option āShow this application in User Portalā is enabled.
Click āNextā.
Click āConfigure Applicationā.
Enter https://albert.tryriot.com/portal/auth/oidc/callback in the Redirect URIs.
Select āClient Secret Postā for the āClient Authentication Typeā option.
In the āLogin URLā field, enter the login URL that is being displayed on Riot.
In āAttribute Mappingā, select the two standard scopes: āEmailā and āProfileā.
Click āActivateā.
On this page, you can retrieve the two values you will need to enter on the Riot platform: the Client ID and the Client Secret.
Copy the values of these fields and paste them in the corresponding fields on Riot.
Your app is now created. Use the left menu to go to User Authentication > SSO Application, and click on the application āRiot Employee Portalā, and go to the āSSOā tab.
In the āAttribute Mappingā section, it is possible that the JumpCloud console may have created duplicated entries for some fields. In our example, it duplicated āemailā and āemail_verifiedā.
Make sure you have removed any duplicated entries and click āSaveā.
Go to the āUser Groupsā tab.
Check the box next to the group of person that should be allowed to connect to the Riot Administration, and click Save. Since this application is meant to be accessed by all employees, you can assign the group āAll Usersā.
The second application is now created, and should appear on the User Portal for the persons who are members of the group which was assigned.
āø Setting an OIDC client at organization level
If you manage several Riot workspaces within the same organization, you do not have to repeat this configuration workspace by workspace.
An OIDC client can be set at organization level. The rule is as follows:
if an OIDC client is configured on the workspace, that one is used;
if no client is configured on the workspace, Riot automatically falls back to the organization's OIDC client, for administrators and employees alike.
This lets you declare your applications once, while keeping the option to override the configuration on a specific workspace.
š Good to know: the steps to create the applications in JumpCloud described above remain identical. Only the place where you enter the Issuer, Client ID and Client Secret in Riot changes.