What is Partner Single-Sign-On?
Introw Partner SSO allows your partner users to access the Introw portal through your identity provider instead of Introw's default email-verification flow.
Introw supports two authentication protocols for partner SSO, so you can connect with whichever your identity provider uses:
SAML 2.0 – the established standard supported by virtually every identity provider.
OpenID Connect (OIDC) – a modern, OAuth 2.0–based protocol, ideal for providers that prefer OIDC over SAML.
In addition, Introw supports SCIM 2.0 for automated partner provisioning and deprovisioning. See the SCIM section below.
How to set this up?
Remark! Reach out to [email protected] if you want to have this feature enabled.
Navigate to your Introw settings > Developers.
You will see a navigation item Portal SSO which contains all the necessary information to configure either a SAML 2.0 or an OpenID Connect (OIDC) connection with your identity provider.
Option A · SAML 2.0
The service provider is already prepared by Introw and available on your subdomain or custom domain. Use the metadata URL from Introw to prepare your internal SAML connection. Once your identity provider is prepared, fill in the Metadata URL and Introw will finalise the connection.
Option B · OpenID Connect (OIDC)
To connect via OIDC, register Introw as an application (client) in your identity provider, then provide the connection details in the Portal SSO settings. You will typically exchange the following:
Issuer URL (or discovery /
.well-knownendpoint) from your identity provider.Client ID and Client Secret generated when you register Introw as an application.
Redirect / Callback URL – copy the value shown by Introw and add it to the allowed redirect URLs in your identity provider.
Scopes – ensure
openid,email, andprofileare granted so Introw receives the required user attributes.
Once these values are filled in, Introw will finalise the connection.
Automated provisioning with SCIM
Beyond just-in-time provisioning at login, Introw supports SCIM 2.0 so your identity provider can automatically keep partner users in sync. With SCIM enabled, Introw will:
Provision new partner users automatically when they are assigned to Introw in your identity provider – no manual invite needed.
Update user attributes (such as name or email) whenever they change in your directory.
Deprovision users automatically – when someone is removed from Introw in your identity provider or leaves the organisation, their access to the partner portal is revoked, helping you stay secure and compliant.
To set this up, open your Introw settings > Developers and locate the SCIM configuration. Introw provides a SCIM Base URL and a bearer token. Enter these into the provisioning settings of your identity provider (for example Okta, Microsoft Entra, or OneLogin) to establish the connection. You can then map SCIM attributes and assign users or groups to control who is provisioned into the partner portal.
As soon as “Enable Partner SSO” is enabled the login experience will shift and your partners will only see a Login with SSO button (this copy can be changed in the tab - portal).
Partner experience with SSO.
If your partners are already authenticated and they click on a link to Introw (from an email for example) they will automatically be logged into Introw and land on their partner portal.
When not authenticated, the partners will land on the login page of the partner portal with a clear CTA to be redirected to Single Sign On.
Partners will now login on your Identity Provider, after the authentication they are redirected back to the partner portal and land within their dedicated partner portal. This works the same way whether your connection uses SAML 2.0 or OIDC.
Example of OneLogin as identity provider
