For customers that are hosted in IDI’s SaaS data center, the URL to login to a customer portal environment will be:
https://myportal365.com/<environment name>/login
A service request can be opened to set an alias that can be used in place of the environment in the URL string. The service request should be assigned to the Networking (Saas) team using the Config Item on the Service Request form. This supports a more branded URL. For example: https://myportal365.com/IDIBillingSolutions/login
For managed service customers, the URL will work the same way; however, a sub-domain specific to the customer will be required in the URL string, following this format:
https://<sub-domain>.myportal365.com/<environment name>/login.For IDI production environments (for training and demo), the URL to login to a customer portal environment will be:
https://idi.myportal365.com/<environment name>/login
Profile-specific login URLs
When different login logos or color themes are being used in your Customer Portal profiles, the login URL will need a query string appended to properly display the profile-specific logo and button color. Start with your login URL and append ?loginProfile=<profile name>. Note that the URL cannot have spaces, so if there is a space in your profile name, replace the space with %20.
Note: If you're coming from OnlineBill, this URL configuration takes the place of market and environment overrides that were available for these admin-level settings: Configuration Settings, Image Management, and Menu Configuration.
Examples:
Login URL for Profile name ‘Southwest’ for environment ABC01_P_Production: https://myportal365.com/ABC01_P_Production/login?loginProfile=Southwest
Login URL for Profile name ‘Southwest Broadband’ for environment ABC01_P_Production: https://myportal365.com/ABC01_P_Production/login?loginProfile=Southwest%20Broadband
Login URL for Profile name ‘Southwest Broadband’ for alias ABCommunications (replaces environment): https://myportal365.com/ABCommunications/login?loginProfile=Southwest%20Broadband
If you have different profiles, but the logo and theme are the same across your profiles, the additional query string is not needed in the URL. Leaving a profile query string off the URL will show the login page with the logo and theme on the Default profile.
Prerequisite Setup for Single Sign-On - OpenID Connect Authorization Provider
SSO requires an OpenID Connect Authorization Provider to be set up in the Security web module in Authorization Provider configuration.
What is OpenID Connect (OIDC)
OpenID Connect is an identity layer built on top of the OAuth 2.0 protocol. It allows web applications to verify users' identities and access basic profile information. Authentication is handled by an identity provider, such as Google, Microsoft, Ping, Okta, or Auth0.
Typical SSO Flow using OpenID Connect.
A subscriber attempts to log in to Customer Portal using your preferred authorization provider.
Customer Portal redirects them to the authorization provider.
The subscriber authenticates with the provider (e.g., by entering their username and password).
The provider authenticates the subscriber and sends an ID token to the Customer Portal, containing information about the subscriber.
Customer Portal verifies the subscriber’s identity.
If verification is successful, access to the Customer Portal is granted.
OpenID Connect Authorization Provider Setup
This must be done by an IDI associate. Submit a service request with the following information.
OpenID Connect Authority URI: Base address for the OpenID Connect provider.
IDI Customer Account Claim: This customizable claim identifies the IDI account number and links a customer portal user to the corresponding IDI account. It's required if you want the system to automatically create a Customer Portal user upon their first login, provided one does not already exist. The value you use depends on whether your company uses a third-party application, such as Salesforce, where subscribers may move from that portal to the IDI Customer Portal. In such cases, use the key employed by the third-party provider for the IDI customer account number.
Force Single Sign-out: Determines whether subscribers are directed to a confirmation page or directed to your organization’s sign-out page.
Important Considerations:
You can have only one OpenID Connect provider.
OpenID Connect providers are associated with a specific Customer Portal user domain to ensure secure and validated access. The system validates these providers for use with the IDI Customer Portal.
Guidelines for Seamless Log in to Customer Portal from Another Application
If you would like to have subscribers seamlessly log in to the Customer Portal from a third-party application, like Salesforce or your own app, redirect them to a URL similar to the following:
https://myportal365.com/{Environment Identifier}/api/v2/oidc/{Provider Identifier}
Environment Identifier: This is the IDI environment you want subscribers to log in to. Typically, it follows the format of IDI01_P_PRODUCTION. However, you have the option to override this value when configuring the Customer Portal.
Provider Identifier: This value is generated by IDI during the configuration of your Authorization Provider above. IDI can supply this value to you.