Signing in with ADFS or a generic OIDC provider
MobilityManager can use Active Directory Federation Services (ADFS) or any standards-compliant OpenID Connect (OIDC) provider for single sign-on. This article covers both, for users and for the administrator who configures them.
Signing in
- Open the sign-in page and select your company (tenant).
- Choose the single sign-on button. The default label is Login with ADFS for ADFS, or Login with SSO for a generic OIDC provider. Your administrator may set a custom label.
- You are redirected to your provider to authenticate, then returned to MobilityManager, which validates the response and starts your session.
Note: On your first SSO sign-in, an account is created automatically with the Driver role. See "How single sign-on users are provisioned."
Provider endpoints
MobilityManager builds the authorization request using the endpoint pattern for the selected provider:
| Provider | Authorization endpoint | Default button text |
|---|---|---|
ADFS | {authority}/oauth2/authorize | Login with ADFS |
| Generic OIDC | {authority}/authorize | Login with SSO |
In both cases the request uses the authorization-code flow with a state value for CSRF protection.
Requirements for a generic OIDC provider
To work as a generic OIDC provider, your identity provider must support standard OpenID Connect discovery. MobilityManager reads the provider's /.well-known/openid-configuration document from the configured Authority to find the issuer and signing keys, then validates the returned identity token's signature, issuer, audience, and lifetime.
What your administrator configures
A SystemAdmin enters these values per company:
| Setting | Notes |
|---|---|
| Provider | ADFS for ADFS, or the generic OIDC option for other providers |
| Authority | The base URL of the provider that serves the OIDC discovery document |
| Client ID | The application or relying-party identifier registered at the provider |
| Client secret | Stored securely and never displayed back in the app |
| Redirect URI | The MobilityManager callback URL, registered at the provider |
| Scopes | Defaults to openid profile email |
| Button text | Optional custom label for the sign-in button |
Tip: For the returned token to validate, the provider must issue the email and a stable subject claim, and its audience must equal the configured client ID. Providers that expose a standard discovery document and JWKS endpoint work without provider-specific tuning.
Troubleshooting
| Symptom | Likely cause |
|---|---|
| "Identity provider token validation failed" | Discovery document unreachable, wrong issuer or audience, or expired token. |
| "OIDC configuration is incomplete for this tenant" | Authority or client ID is missing. |
| Sign-in works but no email is recorded | The provider did not include an email claim in the identity token. |
Related
- Single sign-on: an overview
- Signing in with Azure AD (Microsoft Entra ID)
- Signing in with Keycloak
- How single sign-on users are provisioned
