This guide explains how your company can connect its own Identity Provider (IdP) to the Cofinity-X Portal for Single Sign-On (SSO) using OIDC (OpenID Connect).
You can now configure scopes and user matching (claim mapping) yourself during setup.
Before you start
You need:
the Admin role for your company in the Cofinity-X Portal
an OpenID Connect-compatible IdP, such as Azure AD (Entra ID), Keycloak, or another OIDC provider
from your IdP:
Metadata URL ending in
/.well-known/openid-configurationClient ID
Client Secret
The Redirect URL generated by the portal must be registered in your IdP exactly as provided. Wildcards are not supported.
Step 1: Create the IdP entry
Go to Technical Setup → Identity Provider Configuration
Click on the Add Identity Provider
Enter a name, select Authentication Type: OIDC and Identity Provider Type: Own.
Click Create IdP entry.
Step 2: Enter your connection details
Provide the mandatory information:
Metadata URL: Your application metadata URL
Client ID: Client ID of your Application. In Azure this is the Application ID
Client secret: Client secret of your Application
Identifying Attribute: choose the attribute that identifies your users at sign-in. You will enter this value in the next step and with every user invitation.
Custom template (only if you chose it above): enter your own claim in the format
${CLAIM.attribute_name}, e.g.${CLAIM.employee_id}.Scopes: default is
openid. Add the scope for your attribute if it isn't part ofopenid, e.g.openid email profile.
Matching only works if the scope includes your claim. If you identify users by email, the email scope must be listed.
Copy the Redirect URL shown under Automatically generated metadata and register it in your IdP exactly as provided.
Click Save Metadata.
Step 3: Link your existing user account
Enter your IdP User ID. This must be your value for the attribute you selected in Step 3. For example, if you selected
email, enter your email address as it exists in your IdP.Click Connect.
After the confirmation you have two options:
Close, test later
Sign Out
Step 4: Test the login
Sign Out.
On the login page, enter your business email address and click Next step.
Choose your newly created IdP and click Select.
Sign in with your company credentials. You are now logged in via SSO.
For any questions, feel free to reach out to [email protected].