Third-party identity provider integration

Connect your platform to Oase so that the groups and memberships you manage are mirrored automatically as group spaces in the Oase app — your users log in with their existing account on your platform, and Oase keeps their groups, names and photos in sync.

How it works

Oase binds one of its realms (a top-level group space that contains sub-groups) to your platform as an identity provider. Once bound:

1. Every member of the realm authenticates once against your login page, from inside the Oase app. Your page hands back a token.
2. Oase stores that token and uses it — as a plain bearer token — to fetch the user’s record from a SCIM endpoint hosted by you.
3. From that record, Oase mirrors the user’s groups: each of your groups becomes a sub-group space (a sub-oase) inside the realm, the user is enrolled in the ones matching their groups — and removed from ones that no longer match — and their display name and photo are synced.

Two things are worth internalising early:

• Oase is the SCIM client, not the SCIM server. You host the SCIM endpoint; Oase calls it. You never call into Oase — there is no push or webhook API. All provisioning is pull-based and per-user: Oase fetches one user’s record, authenticated as that user, and reconciles that user’s memberships.
• Groups materialise through their members. A group on your side becomes a group space in Oase the first time one of its members syncs. A group none of whose members ever open the Oase app never appears in Oase.

What you build

Two HTTP endpoints, both hosted by you:

1. A login page (OIDC-style authorization endpoint) that authenticates the user in a browser and redirects back to the Oase app with a token.
2. A SCIM user endpoint that, given that token as a bearer credential, returns the authenticated user’s SCIM record including their groups.

Then read how sync behaves and what the end-to-end flow looks like, and how to get registered.