● B2B Suite · Single sign-on · Release Q1 2027
Single sign-on for Magento Open Source and Mage-OS, per company.
Company members sign in with their company's own identity provider. The store picks the provider from the email domain, and you can make it the only way in. Part of the qoliber B2B Suite: release Q1 2027, early access on request.
● How it works
Four steps, start to finish.
- 01
Add the provider
Add it for a company with its email domains: issuer URL, client ID and secret for OpenID Connect, or entity ID, sign-on URL and signing certificate for SAML 2.0.
- 02
Share the store's addresses
The form then shows the redirect URI, SAML entity ID and assertion consumer address to give the provider's administrator.
- 03
Sign in
The member enters a work email in the Sign in with your company account box, signs in at the provider and comes back to My Account.
- 04
Require it
With Required on, password sign-in is refused for those domains, on the login page and for REST and GraphQL customer tokens.
● What's included
The details that matter.
OpenID Connect and SAML 2.0
Works with providers such as Microsoft Entra ID, Google Workspace, Okta, Auth0 and Keycloak.
A provider per company
Each company has its own providers. An email domain belongs to one active provider.
Members on first sign-in
People of the company's domains can get a store account and a membership on their first sign-in, with the role you choose.
Safe account linking
An existing account is linked through a verified email address, and its owner must be an active member of the provider's company.
Forget linked sign-ins
When a provider is set up again and issues new identifiers, clear the links and members are linked again on their next sign-in.
Encrypted secrets
The client secret is stored encrypted, and leaving the field empty on edit keeps the saved one.
Hyvä and Luma
The sign-in box appears on the customer login page on both.
- A sign-in must start on the store and finish within ten minutes in the same browser. A SAML sign-in started at the identity provider is not accepted.
- The sign-in box appears only while single sign-on is enabled and at least one provider is active.
- A provider that sends no email_verified claim, such as Entra ID, needs Trust its e-mail addresses turned on before existing accounts can be linked.
● Questions
Before you ask.
Which identity providers work?
Providers that speak OpenID Connect or SAML 2.0, such as Microsoft Entra ID, Google Workspace, Okta, Auth0 and Keycloak.
Can each company use its own provider?
Yes. Providers are set per company, and the store picks one from the member's email domain.
Can we turn off passwords for a company?
Yes. Mark the provider as Required and password sign-in is refused for its domains, including REST and GraphQL customer tokens.
Do people need an account first?
Not if you turn on Create members on first sign-in. Without it, someone with no account is told to ask their company administrator for an invitation.
Is this for admin users?
No. It signs in company members on the storefront.
When can I use it?
The B2B Suite release is planned for Q1 2027, and early access is granted on request.
More B2B Suite features
● Release Q1 2027
Start before the release.
Early access is granted on request. Tell us about your store or project and we'll get back to you within one business day.