OAuth

URL

The URL that is issued from the identity provider.

Okta: https://dev-9879999.okta.com/oauth2/v1

Token Path

The token endpoint from the identity provider is used to obtain access tokens.

/token

Token Sent Via

Select whether the token is sent via Header or Payload.

Header

Identity Token Sent Via

Select whether the identity token is sent via Header, Payload, or the same method as the Token sent via field.

Token sent via

Identity Path

The user information endpoint is used to retrieve user data. Enter the path from the user endpoint.

Okta: /userinfo

Authorize Path

Enter the path from the authorization endpoint.

Okta: /authorize

Microsoft: /oauth2/authorize

Scope

The scope defines the user access level and permissions that you have configured in the identity provider.

Okta: openid email profile groups offline_access

Microsoft: openid profile email

Param Name for access token

The name of the access token.

access_token

Id

The client ID value from your identity provider.

0oafgyq3qdYPHa55555

Secret

The client secret value from your identity provider.

QTrbVadjfjhurUzsJHRbteQPHHm8Od6w

Login Style

Select the type of the login screen. The options are:

• Redirect

• Popup

• Default

Popup

Button Text

Enter the text that will be displayed on the login button.

Login with Microsoft

Button Text Color

Enter the color of the login text.

Changing the colors may result in non-compliance with WCAG (Web Content Accessibility Guidelines) requirements. Ensure that the new colors meet the recommended contrast and readability standards to maintain accessibility for all users.

#FFFFFF

Button Color

Enter the color of the login button.

#1d74f5

Key Field

Select the field with which users can log in and which will maintain unique user IDs. The options are:

• Username

• Email

Email

Username field

With this field, you can prevent users from selecting their own usernames while signing in for the first time. Thus, users will retain the usernames from the identity provider, maintaining consistency.

Okta: In the Okta profiles of your users, enter values in the Nickname field.

In your Rocket.Chat custom OAuth method, enter nickname value for this field.

Microsoft: You can refer to the userinfo endpoint for details.

Email field

Enter the supported email claim key.

Microsoft: email

Name field

Enter the supported name claim key.

Mircosoft: given_name, family_name, or name

Avatar field

Enter the user avatar field from your identity provider.

Okta: picture

Show Button on Login Page

Enable this option to show the login button on the workspace login screen.

Sync configurations

Roles/Groups field name

Enter the roles or groups field from the identity provider. This will be used to identify which roles or groups need to be merged when the Merge Roles from SSO field is enabled.

roles

Roles/Groups field for channel mapping

Enter the roles or groups field from the identity provider. This will be used to identify the field that should be used to map roles/groups to Rocket.Chat channels.

Okta: If you have groups for the users, Okta can return the groups claim. See the Okta OpenID Connect and OAuth 2.0 guide for details.

Keycloak: For an example of how the mapping works in Keycloak, see the Advanced Configuration example.

User Data Group Map

The admin user used to create rooms defined in the OAuth Group Channel Map field.

rocket.cat

Map Roles/Groups to channels

Enable this option to add users to Rocket.Chat channels.

Merge Roles from SSO

Enable this option to merge user roles from the identity provider to the Rocket.Chat users.

Roles to Sync

List the roles (comma-separated values) that should be synced when the Merge Roles from SSO option is enabled.

Merge users

Enable this option to allow users from OAuth to be merged with existing users on the Rocket.Chat database.

Merge users from distinct services

Enable this option to allow users from OAuth to be merged with existing users regardless of their origin service.

OAuth Group Channel Map

From this mapping, users that belong to the specific groups are inserted into all the associated Rocket.Chat rooms.

Note the following points:

• For this, the Map Roles/Groups to channels field must be enabled.

• You must also provide the groups in the Roles/Groups field for channel mapping field.

• Rooms will be created in Rocket.Chat if they don’t exist. The User Data Group Map value will be set as the room owner.

{
    "Managers": "managers-channel"
}

Here, Managers is the group in the identity provider and managers-channel is the channel in Rocket.Chat. Users in the Managers group will be automatically added to managers-channel upon user login or user account creation.