SSO & SCIM

One login for everyone, no manual account upkeep: with single sign-on your team authenticates via your company's identity provider; with SCIM the identity provider manages the accounts automatically — joiners, role changes, leavers. As an administrator, you set up both yourself.

Single sign-on (OIDC)

Supported: Microsoft Entra ID, Google Workspace, Okta and any other OIDC-compatible identity provider (OpenID Connect, authorization code flow with PKCE) — such as Keycloak, Ping or OneLogin.

What you need

• Administrator rights in Contrixt and in your identity provider
• About 10 minutes

Setup

The wizard under Administration → Single sign-on guides you through four steps (Choose provider → Guide → Credentials → Test & activate):

1. Choose provider — Microsoft Entra ID, Google Workspace, Okta or Other provider (OpenID Connect).
2. Register an app with your identity provider. The wizard shows the matching step-by-step guide for your provider along with ready-to-copy values — in particular the redirect URI, which contains your tenant subdomain. For Microsoft Entra ID, first create a non-gallery enterprise application (Enterprise applications → "New application" → "Create your own application") — Entra automatically creates a matching app registration, which you then configure for the OIDC values (redirect URI, client ID, client secret). You will reuse this one application for SCIM provisioning later.
3. Enter credentials: depending on the provider, the Directory (tenant) ID or Issuer URL, plus Client ID (application ID) and Client secret (stored encrypted). Also set the Role for new users and decide on Create users automatically (JIT): with JIT enabled, Contrixt automatically creates an account with the chosen default role on first SSO sign-in; without JIT only pre-existing users can sign in via SSO.
4. Test & activate: Test connection verifies that the identity provider is reachable; then enable sign-in with Enable SSO.

How to verify it works

Open the team login URL shown in the wizard in a private browser window: the login page now shows the SSO button, and signing in via the identity provider takes you straight into the app. Then share this login URL with your team.

Password login remains available

SSO complements the password login, it doesn't replace it — administrators always keep an access path.

SCIM provisioning

SCIM 2.0 synchronizes users and groups automatically from your identity provider — new team members get their account without any manual work, and leavers are deactivated automatically.

What you need

• A SCIM-capable identity provider (e.g. Microsoft Entra ID or Okta) with administrator rights
• For role mapping: the group names from your identity provider

Setup (example: Microsoft Entra ID)

1. Under Administration → Provisioning, create a bearer token with Generate token and copy it immediately — it is shown only once. Also copy the displayed Tenant URL (SCIM endpoint) (…/api/scim/v2).
2. In Entra ID, open your Contrixt enterprise application from the SSO setup (created as a non-gallery application) — only that one offers the Provisioning menu; an application auto-created from an app registration does not. Select Provisioning and set the mode to Automatic.
3. Enter the tenant URL and the token, then click Test connection.
4. Under Users and groups, assign the groups that should be synchronized to the application.
5. Define the group mapping in Contrixt (see below).
6. Start provisioning — Entra syncs initially and then roughly every 40 minutes; removed users are deactivated automatically.

The setup works analogously with Okta and other SCIM-capable identity providers.

Role mapping

Via group mappings you assign identity provider groups to Contrixt roles (e.g. group IT-Controlling → role Controlling). On sync, each user receives the highest role among their mapped groups — precedence: Administrator > Controlling > Budget owner > Read-only. Without a matching mapping, existing users keep their role unchanged; new users receive Read-only.

Employee attributes (enterprise schema)

In addition to the core attributes (name, email address, status), the SCIM endpoint now also processes the attributes of the SCIM enterprise user schema: department (department), cost center (costCenter), employee number (employeeNumber), division (division) and organization (organization). Previously, these attributes were discarded during sync.

For Contrixt to receive these values, they must be enabled for transfer in your identity provider. For Microsoft Entra ID, check this under Enterprise applications → your Contrixt application → Provisioning → Attribute mappings: for each attribute you need, a mapping from the Entra source attribute (e.g. department, employeeId, costCenter) to the identically named target attribute of the enterprise schema must exist and be enabled — not all mappings are enabled by default. Add any missing mappings via Add new mapping if needed, then restart provisioning so the values are transferred on the next sync.

Contrixt uses these attributes for the employee directory: there they are available as a selectable grouping attribute (department, cost center, division, organization, employee number and others); if they are missing from the SCIM sync, Contrixt fills them in — where available — from the license sync (M365/Google/Adobe).

How to verify it works

After the first provisioning run, Administration → Provisioning shows the transferred groups under Synchronized groups, when the token was last used, and the number of synchronized users; the created accounts appear with their mapped role in the user list.

Operations

• Rotate token creates a new token at any time and invalidates the old one — update it in your identity provider afterwards.
• Delete token stops synchronization immediately.
• Treat the SCIM token like a password.

SCIM-managed accounts

Accounts created via SCIM are fully controlled by the identity provider — invitation emails and local passwords are not intended for them; sign-in runs through SSO.