How to Manage Identity Providers

⚠️ Role required: The features described in this guide require the Organisation Administrator role. If you do not have this role, contact your organisation's administrator.

Identity Providers (IdPs) manage user authentication for your organisation. They allow users to log in using their corporate credentials via OpenID Connect (OIDC) or SAML protocols, enabling single sign-on (SSO) across all Discngine applications.

Navigation

Click on Identity Providers in the left sidebar or on the Identity Providers card on the home page.

The Identity Providers page shows:

At the top of the page:

• OIDC metadata: View the OIDC metadata for your organisation (useful for configuring relying parties)
• New Provider: Add a new identity provider

How to Add an Identity Provider

1. Click New Provider. The panel opens with Provider Type set to OpenID Connect.

2. Choose the Provider Type:

   • OpenID Connect — enter the provider's explicit endpoints (Authorization URL, Token URL, User Info URL).
   • OpenID Connect with Issuer URL — the simplest option: enter only the Issuer URL and the endpoints are discovered automatically. Recommended when your provider supports OIDC discovery (Azure AD, Okta, Cognito…).
   • Security Assertion Markup Language (SAML) — for providers that use SAML 2.0.

3. Fill in the fields for the chosen type.

   For OpenID Connect with Issuer URL (recommended):

   

   Field	Description	Required
   Provider Name	A descriptive name (e.g., "Corporate Azure AD")	Yes
   Issuer URL	The OIDC issuer URL from your provider (e.g., https://login.microsoftonline.com/{tenant}/v2.0)	Yes
   Client ID	The application / client ID from your provider	Yes
   Client Secret	The client secret from your provider	Yes

   (Plain OpenID Connect asks instead for the explicit Authorization URL, Token URL and User Info URL.)

   For OpenID Connect, copy the Web Redirect URI shown in the panel and add it as an allowed redirect / callback URI in your identity provider.

   For SAML — setup is a two-step process:

   

   Field	Description	Required
   Provider Name	A descriptive name (e.g., "Corporate SAML")	Yes
   IdP Endpoint	Your provider's SAML SSO (login) URL	Yes
   Email Claim	The SAML attribute that carries the user's email (a sensible default is pre-filled)	Yes
   Certificate	Your provider's X.509 signing certificate (can be added now or later)	Yes

   1. Create the provider with at least the IdP Endpoint and click Save.
   2. Copy the generated Identifier (Entity ID) and Reply URL from the panel into your identity provider (Azure AD, Okta, …).
   3. Download the signing certificate from your provider and upload it in the Certificate field.

4. (Optional) Set a Secret / certificate expiry date — the Admin Center reminds the provider's managers before the credential expires.

5. Click Test to validate the configuration, then Save.

For provider-specific configuration instructions with screenshots, see the provider setup guides below. The generic OpenID Connect with Issuer URL steps above work for any OIDC-compliant provider that is not listed.

• Azure AD / Microsoft Entra ID
• Okta
• Amazon Cognito
• GitHub
• SAML 2.0

How to Modify an Identity Provider

1. Click Edit next to the desired Identity Provider.
2. Update the necessary fields (e.g., rotate a client secret, update the issuer URL).
3. Click Save.

Tip: When rotating a client secret, update the secret in your IdP provider first, then update it in the Admin Center immediately after to avoid login disruption.

How to Delete an Identity Provider

1. Click Edit next to the desired Identity Provider.
2. Click Delete.
3. Confirm the deletion.

Warning: Deleting an IdP means users who rely on it for SSO will no longer be able to log in via that provider. Ensure affected users have local login enabled before deleting.

Enabling a provider for specific applications

A provider can be enabled per application, so that only the applications you choose offer sign-in through it.

1. Open the provider by clicking its name (or Edit) on the Identity Providers page.
2. Switch to the Application Registration tab.
3. Your applications are listed grouped by environment. Turn the Enabled toggle on for each application that should use this provider for sign-in (and off for those that should not).
4. Click Save.

Related

• Organisation Administrator Guide