Further info about OIDC-based single sign-on

Troubleshooting

Migrating users from Windows-based SSO to the new, OIDC-based solution

From version 9.7, users can migrate their accounts from Windows-based SSO to the OIDC-based one. This happens the same way as with memoQ server accounts:

  1. Users sign in to the memoQ server with their OIDC-based account.

  2. They choose the I worked on this server before option when asked, and enter their Windows AD username and password.

  3. memoQ server links the two accounts, and afterwards, users can only sign in with their OIDC account.

Users who switch to an OIDC provider keep their previous permissions and group memberships. When a memoQ administrator synchronizes memoQ server with Windows Active Directory, group memberships of such users will be updated.

If the organization keeps the Windows-based SSO even after setting up OIDC-based SSO, you can migrate a user back to the Windows-based system. Delete their account in memoQ or memoQWeb, then sync your memoQ server with Windows Active Directory. The account will appear in the user list again as a Windows AD user.

General schema of the OIDC-based user authentication

The new way of approving users’ identity is based on the OpenID Connect protocol that is supported by leading ID providers - also known as Identity and Access Management (IAM) systems. These schemas show how the user authentication flow happens in the memoQ desktop app and in memoQWeb.

Identifying the user in the memoQ user database

  1. If the user is found in the user database, memoQ’s normal authorization flow starts, and the user gets their license and permissions (that is, they are logged in).
  2. If the user is not found, it means this is the first time they try to log in with these IDP credentials. Depending on whether the user has worked before on this memoQ server, the Authentication Manager will create a new user for them, or update the old one (see the details later).

Tips for test environments

There are two things that can simplify SSO setup, but should not be used in production environments. However, when you first try out this feature, you might want to get through the setup faster.