This article guides setup of RapidIdentity as a client-managed identity provider for signing into Finalsite, including what to configure as a Federation Partner in RapidIdentity and which values to send to Finalsite to complete the connection.
💡Quick answers
- What is this setup used for? Signing into Finalsite using RapidIdentity as the identity provider, with the school's own IT team keeping full control over the Federation Partner Finalsite uses.
- Which protocol does it use? OpenID Connect (OIDC). Finalsite does not use SAML for this connection.
- What access is needed before starting? Administrative access to the school's RapidIdentity tenant, and permission to create or edit Federation Partners under Configuration → Security → Identity Providers.
- What does Finalsite need at the end of setup? Three values: the Client ID, Client Secret, and the RapidIdentity tenant URL, sent over a secure channel rather than email.
- What does Finalsite provide? One value, a Callback URL, to enter when creating the Federation Partner. Everything else is generated on the school's side.
- Is this the only way to set up RapidIdentity sign-in? Schools unsure whether this level of control is the right fit for their environment should confirm with Finalsite Support or Professional Services before starting.
RapidIdentity is Identity Automation's identity and access management platform. Not familiar with it? RapidIdentity's own help center covers the basics of the platform. Setting it up as a client-managed identity provider lets a school's own IT team register and control the Federation Partner Finalsite uses, rather than relying on a connection Finalsite manages by default.
This guide walks through registering a Federation Partner in RapidIdentity, configuring the claim attributes Finalsite needs, generating the values Finalsite needs, and where to go if something stops working.
In this article
- When to use this setup
- Before starting
- Step 1: Open the Federation Partners screen
- Step 2: Name the Federation Partner
- Step 3: Add the Finalsite Callback URL
- Step 4: Configure the claim attributes
- Step 5: Save and capture the Client ID and Client Secret
- Step 6: Send the values to Finalsite
- Troubleshoot common issues
- Alternative: Not sure this is the right setup?
Am I eligible, and how does this work?
This setup is available to schools that require full control over the RapidIdentity Federation Partner Finalsite uses for authentication. Schools that are unsure whether this is the right option should confirm with Finalsite Support or Professional Services before starting.
Once set up, this works as a sign-in option, not a data sync. Instead of typing a Finalsite password, someone signs in with their RapidIdentity credentials. RapidIdentity checks who they are and sends Finalsite a confirmation; Finalsite never sees or stores the RapidIdentity password.
Setting this up requires registering a Federation Partner in RapidIdentity, configuring a small set of claim attributes, and sending Finalsite three values from that registration. The steps below cover exactly what to do and where to find each value.
When to use this setup
Use this setup when a school requires full control over the RapidIdentity Federation Partner Finalsite uses for authentication. If it's unclear whether this is the right option for the school's environment, Finalsite recommends confirming with Finalsite Support or Professional Services before starting.
Before starting
Confirm access to the following before beginning:
- Administrative access to the school's RapidIdentity tenant.
- Permission to create or edit Federation Partners under Configuration → Security → Identity Providers.
- The school's RapidIdentity tenant URL handy, in the form
https://<your-tenant>.us001-rapididentity.com.
Finalsite also provides one value needed during setup:
-
Callback URL:
https://auth-us-east1.finalsite.com/oauth2/callback— this is the only value Finalsite provides. Everything else is generated on the school's side and sent back to Finalsite at the end.
⚠️ Important Note
A mismatched Callback URL is the most common reason sign-in fails after setup. Paste the value above into the Callback URL field exactly as written, with no trailing slash or extra path.
RapidIdentity may not display the Client Secret again after it's first generated in Step 5. Copy it somewhere secure immediately; if it's lost later, the only fix is regenerating it.
Step 1: Open the Federation Partners screen
- Sign in to the RapidIdentity admin console with an administrative account.
- Go to Configuration → Security → Identity Providers → Federation Partners.
- Click Add Federation Partner, then choose OpenID Connect as the type.
Need more help? Visit RapidIdentity's guide: OpenID Connect (OIDC) authentication.
Step 2: Name the Federation Partner
Enter a name for the Federation Partner, such as Finalsite, or any name that helps identify it later. This name is for the school's own internal records and is not sent to Finalsite.
Step 3: Add the Finalsite Callback URL
In the Callback URL(s) field, paste the value Finalsite provided exactly as written, with no trailing slash or extra path:
https://auth-us-east1.finalsite.com/oauth2/callback
Step 4: Configure the claim attributes
Add the following claim attributes so Finalsite receives the user details it needs. For each one, set Claim Type to string and Attribute Value Type to ldap, and leave the REGEX Filter blank.
| Name | Claim | LDAP Attribute |
|---|---|---|
email |
mail |
|
| Family Name | sn |
sn |
| Given Name | given_name |
givenName |
| Picture | picture |
idautoPersonPhotoURL |
The Picture claim maps to an Identity Automation-specific LDAP attribute used for profile photos. It's optional; leave it out if the school doesn't want a photo field synced.
Need more help? Visit RapidIdentity's reference: OpenID Connect user endpoints.
Step 5: Save and capture the Client ID and Client Secret
Save the Federation Partner. RapidIdentity generates a Client ID and Client Secret at this point; copy both immediately; RapidIdentity may not display the Client Secret again later.
Step 6: Send the values to Finalsite
Send the Finalsite contact the following three values. Use a secure channel; the Client Secret is sensitive and should not be shared by email.
| Field | Where to find it |
|---|---|
| Client ID | Step 5, generated on save |
| Client Secret | Step 5, generated on save (copy immediately) |
| RapidIdentity tenant URL | The school's own RapidIdentity URL |
Finalsite derives the OIDC endpoints it needs directly from the tenant URL above; no further information is required from the school's IT team. Finalsite uses these values to configure the connection, tests it, and confirms once sign-in is working for the school's users.
Troubleshoot common issues
-
Sign-in fails right after setup. This is almost always a mismatched Callback URL. Confirm the value in Federation Partners matches
https://auth-us-east1.finalsite.com/oauth2/callbackexactly, with no trailing slash or extra path. - Sign-in doesn't connect at all. Double-check the tenant URL sent to Finalsite in Step 6; Finalsite derives the connection endpoints from it, so an incorrect tenant URL will prevent the connection from working.
- A user's name or email is missing in Finalsite. Revisit the claim attributes configured in Step 4 and confirm the Claim and LDAP Attribute values match exactly what's listed there.
- The Client Secret was lost before it could be sent to Finalsite. RapidIdentity may not display it again after generation. Regenerate the Client Secret for the Federation Partner and send the new value to Finalsite.
- Errors related to the Picture claim. The Picture claim is optional and not required for sign-in to work. Remove it from the claim attributes if it's causing errors.
Alternative: Not sure this is the right setup?
This setup is for schools that require full control over the RapidIdentity Federation Partner Finalsite uses. If it's unclear whether this is the right approach for the school's environment, check with Finalsite Support or Professional Services before starting; they can confirm the best path for the school's specific RapidIdentity setup.
Comments
Please Sign in to leave a comment if you don't see the comment box below.