Set Up Single Sign-On (SSO) for Your Space Viewer

Your users sign in to the viewer with their company account; they do not need an additional rooom password. For setup, we need three pieces of information from your identity provider.

rooom uses OpenID Connect (OIDC) based on OAuth 2.0 for this. Any identity provider that supports this standard can be connected, such as Microsoft Entra ID (formerly Azure AD). SSO is configured per viewer, not for the entire account.

What Happens During Login

When someone opens the viewer link, rooom checks if there is already a valid login for that viewer. If not, it redirects to your company’s login page, which your users recognize from other corporate applications. Afterwards, they return to the viewer.

We never see passwords. Your identity provider only confirms the login and transmits the name and email address.

How long the login lasts is determined by your identity provider’s login ticket, often about one hour. When it expires, rooom redirects there again. If the session is still active, your users won’t notice anything.

Who Gets Access

SSO checks exactly one thing: Can this person log in to your company? The viewer does not filter by department, role, or group. If not everyone should have access, restrict the app registration in your identity provider to only the intended users or groups.

The Three Pieces of Information We Need from You

They are all created once your IT team sets up an app registration for rooom.

Client ID: The identifier of the app registration. It is not secret and uniquely assigns your access.

Client Secret: The password of the app registration. rooom uses it to authenticate with your identity provider, so treat it confidentially.

Metadata Document URL: The address where your identity provider technically describes its configuration. rooom reads this automatically. For Microsoft Entra ID, for example: https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration

How to Proceed

1. Tell your Customer Success contact or rooom Support which space or viewer you want SSO for.
2. Your IT team creates the app registration, enters the redirect URI https://viewer.rooom.com/oAuth, and enables the scopes openid, profile, and email.
3. Send us the Client ID and Metadata Document URL by email, and the Client Secret via a secure method (see below).
4. We enter the details in the viewer and activate the login.
5. Then you test the link together with us, preferably in a private browser window using an account not yet logged in.

Securely Transmitting the Client Secret

Client ID and Metadata Document URL are not sensitive and can be sent by email. The Client Secret should not: sent in plain text, it remains permanently in mailboxes and backups. Instead, use a one-time link service that deletes it after the first access, such as 1Password Send, Bitwarden Send, or onetimesecret.com. You can email the link itself normally. A company password manager with sharing functionality works just as well; just briefly agree on who gets access.

Technical Details for Your IT Team

• Redirect URI: https://viewer.rooom.com/oAuth
• Protocol: OpenID Connect 1.0, OAuth 2.0 Authorization Code Flow
• Token Format: JWT, signed with RS256
• Required Scopes: openid, profile, email
• Configuration Level: per viewer, not global for the account
• No evaluation of role or group claims

Process: The user opens the viewer link. If there is no valid OIDC session for this viewer, rooom redirects to the customer’s SSO login. After login, rooom validates the RS256-signed ID token and the user lands in the viewer.

When the Client Secret Expires

Most identity providers set an expiration date for client secrets. When reached, login to the viewer fails and your users see an error message. Note this date during setup and send us a new secret in time. The same applies when switching identity providers or creating a new app registration: let us know in advance so we can update the configuration before access is interrupted.