Setup

Your identity team creates the application at your identity provider with the values below, and sends Retorio its details. Field names and steps differ between identity providers, so match each value by what it does.

Values from Retorio

Value	Use it as
Callback URL: https://platformfirebase.firebaseapp.com/__/auth/handler	ACS URL or Reply URL (SAML), redirect URI (OIDC, Microsoft, Google). Your provider sends the sign-in result here
Login link: https://coaching.retorio.com/login?org=<organization name>	Start URL or home URL, where users begin. The organization name is the unique name chosen when your Retorio organization was created
SAML entity ID	Entity ID, audience or identifier. Sent by Retorio during setup

Per method

SAML 2.0

Field	Value
ACS URL / Reply URL	Callback URL
Entity ID / Audience	From Retorio
Start URL / Home URL	Login link
Binding	HTTP-POST
NameID	The user’s email address
Encryption	Off
Send Retorio	Federation metadata XML, or the IdP entity ID, IdP SSO URL and signing certificate (X.509, Base64)

OIDC

Field	Value
Client type	Confidential
Flow	Authorization code, “Require PKCE” off
Redirect URI	Callback URL
Scopes	openid, email, profile
Send Retorio	Issuer (from /.well-known/openid-configuration, with any tenant path), client ID, client secret

Microsoft

Field	Value
Where	App registration in Entra ID
Redirect URI	Callback URL
Consent	If users cannot approve apps, an Entra administrator grants consent once
Send Retorio	Client ID, client secret

Google

Field	Value
Where	OAuth client in the Google Cloud console
Redirect URI	Callback URL
Send Retorio	Client ID, client secret

Send client secrets through a secure channel agreed with your Retorio contact, never by plain email. Send a new secret or signing certificate before the current one expires or you switch.

Email matching

The email address is the join key. The address your provider sends, as the SAML NameID or the OIDC email claim, must be the address the user was invited with, compared ignoring case and surrounding whitespace, or the sign-in fails. If people have aliases or several domains, pick one address per person and use it in both places.

Provider	Check
Entra ID over SAML	The default NameID is the UPN (user.userprincipalname). If your UPNs differ from the invited addresses, set the NameID to user.mail
Entra ID over OIDC	Entra sends the email claim only when an email address is set on the user account. Make sure it is set

If needed, Retorio can read the invited address or the user’s name from a custom attribute. Your provider still has to send the standard email field. Raise it during setup.

Network and browser

Single sign-on needs these on top of the domain allowlist Retorio provides separately. A blocked pop-up looks like a sign-in button that does nothing.

Allow	Why
coaching.retorio.com, with pop-ups allowed	The sign-in window opens from it as a pop-up
Your identity provider’s sign-in host, such as login.microsoftonline.com or accounts.google.com	The pop-up opens your identity provider’s sign-in page

Sign in once from a managed device on your corporate network before the rollout, so a blocking policy shows up with one test user.