Set up Single Sign-On (SSO) for your Space Viewer

With Single Sign-On, your users log into the Viewer using their familiar company account, without needing an additional rooom password. To enable this for you, we need three pieces of information from your company’s Identity Provider.

rooom supports Single Sign-On via the open standard OpenID Connect (OIDC) based on OAuth 2.0. This allows integration with any Identity Provider that supports this standard, such as Microsoft Entra ID (formerly Azure AD). The login is configured per Viewer, meaning per 3D presentation or Space. This way, you can specifically control which content is visible only to logged-in employees of your company.

What happens during login

When someone opens the Viewer link, rooom first checks whether that person already has a valid login in your company. If not, they are automatically redirected to your company’s login page, the same page they know from other company applications.

After successful login, the person is automatically returned to the Viewer. rooom does not store any passwords. We only receive confirmation from your Identity Provider that the login was valid, along with the user’s name and email address.

Important to know: SSO verifies whether someone can successfully log in to your company. It does not restrict access to specific departments, roles, or groups. Once you activate SSO for a Viewer, all users who can log in through your Identity Provider will have access. If you want to limit the user group, you can manage this within your Identity Provider by only granting the app registration to certain users or groups.

The three pieces of information we need from you

All three values are created when your IT team sets up a new app registration for rooom in your Identity Provider. This is an entry that allows your company to authorize rooom to verify logins.

Client ID

The Client ID is the identifier of the app registration, similar to a customer number. It is not secret and helps us clearly assign your access.

Client Secret

The Client Secret is the password associated with the app registration. It is how rooom authenticates itself to your Identity Provider. Treat this value as confidentially as a password.

Metadata Document URL

The Metadata Document URL is an internet address where your Identity Provider technically describes how the login process works. rooom automatically reads this address, so no manual updates are needed. For Microsoft Entra ID, for example, it looks like this: https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration

How to proceed

1. Inform your Customer Success contact or rooom Support for which Space or Viewer you want to use SSO.
2. Provide your IT team with the Redirect URI from the technical section. It must be entered in the app registration; otherwise, login will fail.
3. Have your IT team create the app registration and enable the scopes openid, profile, and email.
4. Send us the Client ID, Metadata Document URL, and Client Secret via a secure method (see the next section).
5. We will enter the details in the Viewer and activate the login.
6. Then test the Viewer link together with us, preferably in a private browser window using an account that has not logged in before.

How to securely transmit your credentials

Client ID and Metadata Document URL are not sensitive and can be sent by email to your Customer Success contact or rooom Support.

Please do not send the Client Secret in plain text by email, as it would then remain stored permanently in mailboxes and backups. Instead, use a one-time link service that automatically deletes the secret after the first access, such as 1Password Send, Bitwarden Send, or onetimesecret.com. You can then send us the link normally by email. If your company uses its own password safe with sharing functionality, that is also acceptable. In that case, briefly coordinate with your rooom contact about who will have access.

For your IT team: technical details

Redirect URI

The following Redirect URI must be entered in the app registration:

https://viewer.rooom.com/oAuth

If the Viewer is delivered via your company’s own domain, a different Redirect URI may be necessary. Please clarify this with your rooom contact before setup.

Authentication process

1. The user opens the Viewer link.
2. rooom checks if a valid OIDC session exists.
3. If none exists, a redirect to the customer’s SSO login occurs.
4. After login, rooom validates the transmitted token, an RS256-signed JWT.
5. The user lands in the Viewer.

Technical standard

• Protocol: OpenID Connect 1.0 and OAuth 2.0 Authorization Code Flow
• Token format: JWT, signed with RS256
• Required scopes: openid, profile, email
• Configuration level: per Viewer, not global for the account
• No evaluation of roles or group claims

Additional important information

Client Secrets in most Identity Providers have an expiration date. When the secret expires, login to the Viewer will no longer work and your users will see an error message during login. It is best to note the expiration date during setup and send us a new secret in time.

The same applies if your company changes Identity Providers or creates a new app registration. Please inform us in advance so we can update the Viewer configuration before access is interrupted.