FAQ

General

What MFA options (multi-factor authentication types) are there?

Trimble Identity currently supports the below second-factor authentication types.

• Passkeys
• Timed one-time password
• Secondary email

For details, see MFA Types

How long is my token going to last?

We have several tokens involved in Identity. Here is a chart of all of the tokens used and their valid time frame.

Token type	Valid for
Access Token	1 hour
ID Token	1 hour
Access Code	10 minutes
MFA Code	3 minutes
Refresh Token	9 days
Session Cookies	3 days
:::

What is my Consumer Key?

In Trimble Identity, a Consumer Key is synonymous with the terms Application Id (in UUID format), and Client Id.

What administrative requests are available via API in Trimble Identity?

For workflows such as account creation, reset password requests, etc. for Trimble Identity we recommend that all users go through the MyProfile interface. This allows for a streamlined customer experience. The environments for those interfaces are here:

• Stage: https://stage.myprofile.trimblecloud.com
• Prod: https://myprofile.trimble.com

If you want to see all the claims for logged-in users for an application, please submit the userinfo JWT. For any other queries, please contact support at cloudplatform_support@trimble.com

When do customers receive emails from Trimble Identity?

See our list of Transactional Emails for a complete listing of when and what emails are received by end-users.

The user says their account was suspended because of multiple login attempts. How can they fix it?

Trimble Identity uses a throttling and backoff mechanism when the supplied password for a given user is found to be incorrect, growing exponentially up to a maximum of approximately 15 minutes. This means users may see messages about multiple login attempts or suspended accounts. To remedy this, please have them use the ’Forgot Password?’request to unlock their account.

How do I use the State parameter with PKCE?

The state parameter is a string that can have any random value. You can generate it using any random string generator. The state parameter preserves state objects set by the client in the Authorization request and returns the same to the client in the response. To use the state parameter with PCKE with the authorization request, you must include the state with the value to return the state in the callback after authentication. This value is similar in purpose to the state parameter in the OAuth protocol.

State Example Request

https://id.trimble.com/oauth/authorize?scope=openid processing&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fplayground%2Foauth2client&client_id=WCD9D...&state={state}

State Example Response

http://localhost:8080/playground/oauth2client?code=ac5d5...&state={value passed in authorize request}

Can my application force sign on every time instead of checking for an active session?

Yes. An application can force a sign-on for a user instead of taking advantage of single sign-on (SSO) by using the prompt=login query parameter on the /authorize request. The application can then manage separate access/refresh tokens for each user.

Note that using prompt=login means SSO will not work with your application. A user will be required to sign in multiple times if using multiple Trimble apps on the same device.

Does Trimble Identity support Managed Users?

Trimble Identity does not directly support the use of managed users. However, Profiles (formerly Access Management) allows a Managed Users Flow. Please see the Profiles Documentation for more information.

How is Trimble Identity complying with government sanctions against various countries?

The following countries are currently sanctioned and Trimble is enforcing existing policy to block sign-ups and User Logins.

• North Korea
• Cuba
• Syria
• Iran
• Belarus
• Russia

Current users with existing subscriptions in Russia and Belarus continue to be able to sign into their accounts for the time being. The sanctioned countries are subject to rapidly-changing rules, and we will continue to monitor and follow guidance from Trimble Compliance. For further questions, please contact Compliance_Administration@trimble.com

Errors

A user is having issues resetting their password after migrating their profile to Trimble Identity v4.

This issue may be related to accounts set up starting with Capital and _capital letters in legacy versions of Identity. This issue is corrected in the new version, but the best solution is to email cloudplatform_support@trimble.com to get the user’s password reset.

A customer is receiving 401 WAF errors when signing into TID. How can I address this?

We manage an allowlist and denylist for our Web Application Firewall (WAF) for security purposes. You can submit a request to add the customers’ domain(s) to the allowlist to address the 401 errors. Please submit a request using this form to allow-list a domain.

Identity Federation

What is the process to get started with Federated Identities?

The first step of getting Federation Identities set up is to fill in the Google Form. The form submits a ticket to our Identity team. They will start testing as soon as they receive your OIDC or SAML information from the uploaded metadata file. This is generally an XML file where we will parse items such as the claimed user and claimed domain for handling the redirect flow.

The user who submitted the request will see an email from our team to ensure the IDP is configured correctly and test users are being redirected on login to the application.

What is the time frame we can expect for this process?

The time frame for setting up federation depends on each unique case. It can vary greatly depending on several factors such as:

• Responsiveness of the requesting user
• All metadata information is provided for setup
• Current workload of internal teams

Please reach out to the Trimble Cloud Platform Team if you have direct questions or follow-up questions.

What is the Reply URL/redirect URI to use for configuring the external federated system for OIDC federation?

Trimble Identity does not have a common redirect endpoint. Once the Trimble Identity team sets up the Federation configuration, each federation will receive a unique redirect endpoint from our support team. This endpoint will need to be configured on the federating partner’s end.

How can the application identify if the user has logged in with their Native TID account or as a Federated user?

Both the Identity access and ID tokens contain an AMR claim, which indicates if the user signed in with a federated source. Additionally, the ID token contains a ‘federation_origin’ claim, which means a federated source was used. The client applications can refer to the above claims in token to determine the source of login.

Is there a way to remove all accounts provisioned by a federation if we lose the customer? Do we have to delete the linked accounts?

We have two options when a customer wants to remove the federation from their account. We can delete all accounts in a given federated domain, or we can revert them to Trimble native accounts, in which case they will need to set up a password via the normal Identity flow.

Can users set up with federation change their MFA settings?

This is determined by the IDP setup, so if users can or cannot change if they use MFA is determined by the IDP. If you need to change or update this, we recommend reaching out to Trimble Cloud Platform Support Team.

My users are having trouble logging in via a federated Identity provider. Who do they go to for support?

All questions on login issues should be directed to the IdP administrator.

What federated Identity providers are currently supported?

Trimble Identity supports OIDC and SAML protocols. These are standard protocols that most IdPs support.

When using SAML I get this error: “Error! error occurred in SAML Identity call due to: Request signing certificate not found.”

The Trimble Identity SAML implementation currently requires the metadata provided to include a signing certificate. Your service provider should have a configuration setting “Enable signed request.” Enable this configuration setting. From there, download the metadata for the Service Provider (SP) again. The new metadata will include the required certificate and you can try again.

How do I ensure the client credentials grant type in API cloud is configured correctly?

Trimble Identity enforces proper configuration of the client credentials grant type in API Cloud.

1. If the app doesn’t have Client Credentials, then the Client Credential token API call receives the following error message:

{
 "error": "invalid_grant",
  "error_description": "Requested grant is not configured for the client."
}

2. If the application doesn’t have a code grant or an implicit grant, then the following error message appears in the browser:

{
 "error": "invalid_grant",
  "error_description": "client unauthorized for requested grant flow."
}

Why can’t a company administrator choose the data residency settings for all Trimble Identity users within the company? We don’t want individual users to be able to choose this for themselves.

A user’s data residency Data residency refers to the physical or geographic location of a user or organization’s data or information. With Trimble ID, users can select their data region where their Trimble ID information is stored, and applications can retrieve the users’ data storage region preference from id and access tokens.” settings are determined by whoever controls the user’s data. Depending on the situation, this could either be:

The user if the user does not have a federated ID. A user could belong to multiple accounts/companies, which may require or have conflicting needs for data settings, so the user has the ability to set their region as needed.

The Identity Provider (IdP) of the user if the user is federated. With federation, the company decides which region they want their user to be associated with.

A company’s federation can only be associated with one region.

Currently, there is no plan to implement the necessary account management capabilities (ex. an account hierarchy to determine which account settings can override others), which could grant companies the ability to manage data regions at the individual user level.

Security and Privacy

Where can I find out more about Trimble’s Privacy Policy?

You can read more about our Privacy Policy on the Trimble Privacy Center.

What security certifications does Trimble Identity have?

Trimble Identity is ISO27001 and NIST 8001-171 certified.

Is Trimble Identity SOC 2 Type 2 certified?

No, but it is in process. Last updated June 2025.

Is Trimble Identity FedRAMP certified?

No. Last updated June 2025.

Captcha

What is a Captcha and why is it used?

A CAPTCHA is a program or system intended to distinguish human from machine input, typically as a way of preventing spam and automated extraction of data from websites. If a user is suspected of being a bot or behaving suspiciously, a delay is introduced in the loading time for each action to verify the identity and progress to the next step.

How does Trimble Identity utilize Captcha?

Trimble Identity utilizes Captcha to add a layer of security to protect against bot attacks, regardless if [multi-factor authentication Multi-factor authentication (MFA) provides a method to verify a user’s identity by requiring them to provide more than one piece of identifying information. This ensures that only valid users can access their accounts.” is enabled.

What triggers Captcha?

Users will see a delay in loading to the next page/action when Trimble Identity has identified a vulnerability or sign that the user signing in may be a bot or unauthorized user. The types of events that could trigger this include the user signing in on an unknown device or a user has signed in and out several times.

Can Captcha be disabled?

No. There is no ability for a user or integrator to disable Captcha.

Is Captcha used for Trimble Identity federated users?

No. Currently, federation isn’t set up for Captcha. Federation is a type of secure login where a user’s single authentication ticket, or token is trusted across multiple IT systems.