ATS reference relying partyhh2 token issuer · OpenID Connect

Connect ATS

Stands in for the button in hh2 that hands a signed-in user to the ATS.
The authorize request must go to the customer's own hh2 hostname, not the shared services host. The issuer resolves which customer — and which identity provider — from the host the request arrives on. Sent to the shared host it answers "Tenant context was not found. Sign in via your company's hh2 web address." That is the design working, not a fault: it is also what makes silent sign-on possible, because the session cookies are host-only.
Customer hostname
Becomes iss = https://<host>/auth. The issuer answers under /auth on every customer hostname.
Front door
Login hint
Wrong door sends neither flag, which takes hh2's employee door — a customer recruiter ends up at hh2's internal staff IdP with no account there. Worth seeing once.

Configuration

Endpoints are read from discovery on the host above, never hardcoded.
Default issuerhttps://services-dev.hh2.com/auth
Client ID4d33474c-1436-3ca2-8d59-2b0af992df9a
Redirect URIhttps://ats-dev.hh2.com/auth/hh2/callback