Get started with Opti ID
Opti ID provides multiple options for managing user identity and permissions so you can choose the best fit for your organization.
Note
Opti ID is only for users of Optimizely products.
- Local login – Invited users configure Opti ID-specific accounts. You manage user identity and permissions within Opti ID.
- SSO without SCIM – Invited users log in to Opti ID through an Opti ID single sign-on (SSO) app that you add to your identity provider's (IdP's) app portal. See Overview of configuring your own SSO for Opti ID. You manage user permissions within Opti ID.
- SSO with SCIM – Invited users log in to Opti ID through IdP. You manage user identity and permissions within your IdP and automate the information flow between your IdP and Opti ID. See Overview of SCIM provisioning for Opti ID.
Note
Opti ID lets you configure up to five SSO connections for your organization. If you create multiple SSO connections, you can only use SCIM for one of those SSO connections.
Go to the corresponding section for the configuration you want to implement.
Important
For step-by-step instructions on configuring Opti ID for CMS 12, see Configure Opti ID for CMS 12. To configure Opti ID for Configured Commerce, see Enable Opti IDEnable Opti ID.
Option 1: Configure local login
Local login configures Opti ID-specific accounts for invited users. You manage user identity and permissions within Opti ID.
- Complete the initial technical contact login. This person logs into Opti ID first and configures it for the rest of your organization. Contact your Customer Success Manager (CSM) if you do not know who the technical contact is. You can change the technical contact later.
- (Optional) Brand your login page.
- Review the local user password policy and how to reset your password.
- (Optional) Configure multi-factor authentication (MFA).
- Review the system roles for your Optimizely products. If you want to personalize permission levels, create custom roles.
- Create groups to simplify giving multiple users the same level of access.
- Invite users, assigning them to roles or groups so that they have the appropriate access to your Optimizely products.
Option 2: Configure SSO without SCIM
SSO without SCIM lets invited users log in to Opti ID through an Opti ID SSO app that you add to your IdP's app portal. You manage user permissions within Opti ID.
- Complete the initial technical contact login. This person logs into Opti ID first and configures it for the rest of your organization. Contact your CSM if you do not know who the technical contact is. You can change the technical contact later.
- (Optional) Brand your login page.
- Configure SSO. You can configure up to five SSO connections. You can use any IdP that supports SAML or OIDC protocols.
- Configure the SAML or OIDC SSO connection in your IdPConfigure the SAML or OIDC SSO connection in your IdP.
- (Optional) Sync groups from your IdP to Opti ID.
- (Optional) Configure organizational domains to automatically provision users who log in with a specific domain.
- (Optional) Enable IdP-initiated login for a more seamless login experience.
- Review the system roles for your Optimizely products. If you want to personalize permission levels, create custom roles.
- Create groups to simplify the process of giving multiple users the same level of access.
- Invite users, assigning them to roles or groups so that they have the necessary access to your Optimizely products.
Option 3: Configure SSO with SCIM
Note
Optimizely officially supports SCIM provisioning with Entra ID, Okta, and PingOne. Other IdPs are not officially supported for SCIM provisioning, and Optimizely does not assist with custom configuration or troubleshooting.
SSO with SCIM lets you manage user identity and permissions within your IdP and automate the information between your IdP and Opti ID.
- Complete the initial technical contact login. This person logs into Opti ID first and configures it for the rest of your organization. Contact your CSM if you do not know who the technical contact is. You can change the technical contact later.
- (Optional) Brand your login page.
- Configure SSO. You can configure up to five SSO connections if needed. You can use any identity provider (IdP) that supports SAML or OIDC protocols.
- Configure the SAML or OIDC SSO connection in your IdPConfigure the SAML or OIDC SSO connection in your IdP.
- (Optional) Enable IdP-initiated login for a more seamless login experience.
- Configure SCIM in your IdP. If you create multiple SSO connections, you can only use SCIM for one of those SSO connections.
- Generate a SCIM token in Opti ID – Use the self-generated SCIM token to configure a SCIM provisioning app for your IdP of choice.
- Create a SCIM provisioning app in Microsoft Entra ID – Use OIDC or SAML for SSO, and manage SSO and SCIM on two separate Entra ID apps.
- Create a SCIM provisioning app in Okta – Use OIDC or SAML for SSO, and manage SSO and SCIM on two separate Okta apps.
- Create a single Okta app for SCIM provisioning and SAML SSO – Use only SAML for SSO, and manage SSO and SCIM on a single Okta app.
- Create a SCIM provisioning app in PingOne – Use OIDC or SAML for SSO, and manage SSO and SCIM on two separate PingOne apps.
- Review the system roles for your Optimizely products. If you want to personalize permission levels, create custom roles.
- Create groups in your SCIM app to simplify the process of giving multiple users the same level of access.
- Add users to your SCIM app, assigning them to roles or groups so that they have the necessary access to your Optimizely products.