SSO Configuration — Rapid Lens Knowledge Base

Licence Required

Single sign-on (OIDC & SAML) is an Enterprise plan feature and is configurable by the Admin role only. If your licence does not include SSO, the configuration form is hidden. See License Management.

Rapid BI Catalog supports two single sign-on protocols — OpenID Connect (OIDC), the recommended option, and SAML 2.0. Both integrate with major identity providers such as Okta and Microsoft Entra ID. Choose the protocol that matches your IdP and configure it below.

SSO vs. local login is chosen at setup

Whether your users sign in with SSO or with local accounts is a one-time decision made during initial setup. See User Management for that choice; this page configures the SSO connection itself.

OIDC Configuration (Recommended)

When the SSO Protocol is set to OIDC, configure your provider's OpenID Connect application:

Field	Description
Issuer URL	Your IdP's OIDC issuer URL. Rapid BI Catalog uses standard discovery (`/.well-known/openid-configuration`) to find the authorization, token, and JWKS endpoints.
Client ID	The client identifier of the OIDC application registered at your IdP.
Client Secret	The client secret for that application. It is stored encrypted.
Scopes	The OIDC scopes to request. Defaults to `openid email profile`; `openid` and `email` are required and cannot be removed.

Redirect URI

Register this redirect URI on your IdP application: https://<bi-catalog-url>/api/v1/sso/oidc/callback. If you reuse the same IdP application for Tableau Connected Apps with OAuth 2.0 Trust, also register https://<bi-catalog-url>/api/v1/sso/caoa/callback — see OAuth 2.0 Trust (Okta) Setup.

SAML 2.0 Configuration

When the SSO Protocol is set to SAML, configure the IdP and Service Provider details below.

Identity Provider (IdP) Configuration

Configure your Identity Provider using one of two methods:

Method 1: Import From XML Metadata (Recommended)

Paste XML directly into the text area, or upload an .xml file.
Click Import Metadata.
If successful, the configuration fields are automatically populated.

Method 2: Configure Manually

Enter each field individually:

Field	Description
IdP Entity ID *	The unique identifier of your Identity Provider
IdP SSO URL *	The login URL provided by your IdP (must be a valid URL)
IdP Certificate *	The X.509 signing certificate from your IdP, used to verify incoming SAML assertions

The certificate can be provided by pasting raw PEM text or uploading a PEM-encoded certificate file (.pem, .cert, or a .cer/.crt exported in PEM format). Rapid BI Catalog validates the certificate and shows its status:

Badge	Meaning
✅ Valid	The certificate is active and valid
⚠️ Expiring Soon	The certificate is nearing its expiry date
⚠️ Not Yet Valid	The certificate's validity period has not started
❌ Expired	The certificate has expired
❌ Error	The certificate could not be validated

Service Provider (SP) Configuration

Field	Description
SP Entity ID *	The unique identifier for this application (also known as the Audience URI). Must be a valid URL.

Click Download Metadata XML to download the SP's SAML metadata file. Upload this to your Identity Provider to complete the trust relationship between the two systems.

Advanced Options

Setting	Description
Require Signed SAML Response	When enabled, Rapid BI Catalog requires the full SAML response (in addition to the assertion) to be signed by the IdP. Enable only if your IdP signs the entire response.

User Provisioning

SSO users are provisioned automatically — there is no separate setting to turn this on or off. At each SSO sign-in, Rapid BI Catalog matches the user to an existing account by email(linking it to the IdP on first use), or creates the account automatically if none exists. Because matching is by email, every user's email address must be configured correctly at your Identity Provider.

Licence quotas apply

Provisioning and role changes respect your plan's per-role and total user limits. If a limit is reached, the sign-in or role change is blocked. See License Management.

Role Mapping

Enable Role Mapping to derive each user's role from their group membership at the Identity Provider. When enabled, roles are re-synchronized from the IdP on every login — so role changes you make at the IdP take effect automatically, and roles cannot be changed locally for SSO users.

Field	Description
Group Attribute Name	The name of the IdP assertion attribute that contains the user's group memberships
Admin Group	Users in this IdP group are assigned the Admin role
Power User Group	Users in this IdP group are assigned the Power User role
Read Only User Group	Users in this IdP group are assigned the Read-Only User role

Unmatched users are denied by default

With Role Mapping enabled, a user who belongs to none of the mapped groups is denied access — unless you enable Allow Non-Group Users, which then signs them in with the Default Role (Read-Only by default).

Testing the SSO Configuration

When SSO is enabled, a Test SSO button appears next to Save. Clicking it runs automated checks against the currently saved configuration.

Result	Description
✅ All checks passed	All required fields are correctly configured. A live login test prompt appears.
❌ Some checks failed	One or more fields are missing or invalid. Failed fields are highlighted on the form.

Save Before Testing

If there are unsaved changes, a warning is displayed and you are prompted to save first. Tests run against the saved configuration — not unsaved form state.

If all checks pass, an Open Test Login button appears. Clicking it opens the SSO login flow in a new browser tab to validate the full end-to-end authentication redirect with your IdP.

SSO and Tableau Connected Apps

The SSO configured here is for signing in to Rapid BI Catalog and works with any supported OIDC or SAML provider. It is separate from Connected Apps with OAuth 2.0 Trust, which uses your IdP to authorize Tableau access. OAuth 2.0 Trust is currently validated with Okta — see OAuth 2.0 Trust (Okta) Setup for that integration.

Next Steps

Require a second factor: Multi-Factor Authentication
Manage user accounts: User Management
Review role permissions: User Roles & Access Control
Authorize Tableau via Okta: OAuth 2.0 Trust (Okta) Setup