Audience: Customers who manage their own Identity Provider (Azure AD / Entra ID, Okta, etc.).
Purpose: Step-by-step procedure to create a new OpenID user in Xytech and link them to your IdP so they can sign in via SSO using the External Authentication Key (Ext Auth Key).
Prerequisites
Administrative access to Xytech (e.g. Super User)
The user already exists in your IdP (Azure AD / Entra ID, Okta, etc.).
One of the following IdP attributes for the new user:
Email address (e.g., j.doe@yourdomain.com).
Object ID / Subject ID (GUID, e.g., c3d53b00-XXXX-4558-9895-303b15ac64eK).
Which value to use depends on your OpenID Mapping (see Step 1).
Step 1 - Determine Your Claim Type
In Xytech, go to System → Setup → OpenID Mapping (v10+). *For v9 or older, see note below.
Check whether the mapping expects UPN (email) or SUB (Object ID).
If UPN: use the user’s IdP email as the Ext Auth Key. If SUB: use the user’s Object/Subject ID as the Ext Auth Key.
*Note: If you are running v9 or lower, or are unsure of your mapping, navigate to System - Users, open an existing user, and check the Ext Auth Key field. If the value in this field is set to an email, this means the mapping expects UPN (email). If the value in this field is set to an alphanumeric value, this means the mapping expects SUB (Object ID). Please contact Fabric Support for further guidance.
Step 2 - Create the Contact Record
Go to System → New → Contact.
Change List Type from Company to Individual.
Complete required fields (highlighted in yellow): First Name and Last Name at minimum.
Click Save.
Step 3 - Add the User Profile
On the Contact, locate the Profiles section (right side).
Click the + button.
From Profile, select User.
Click OK, then Save & Close.
Optional: In the Copy From Contact dialog, choose an existing user to replicate settings and roles, or click Save & Close to skip.
Step 4 - Configure the User and Set the Ext Auth Key
The User page opens automatically after adding the profile.
User ID — optionally rename to your preferred convention (e.g., first initial + last name).
Ext Auth Key — critical for SSO linkage. Enter the value based on your mapping:
If UPN: paste the user’s IdP email (e.g., j.doe@yourdomain.com).
If SUB: paste the user’s Object/Subject ID exactly (e.g., c3d53b00-XXXX-4558-9895-303b15ac64eK).
Update other fields as needed (e.g., Sky Access, department).
Copy and paste directly from your IdP. Do not retype. Any mismatch (case, whitespace, or extra characters) can cause login failure.
Step 5 - Assign Access (Super User or Roles)
Option A — Super User: check the Super User box to grant full access.
Option B — Role-based access: on the Security tab, click + to add roles. Use the ellipsis to select an existing role or double-click blank space to create a new one.
Step 6 - Save and Close
Click Save & Close on the User record.
Click Save & Close on the Contact record.
The user is now created in Xytech and linked to your IdP. They can log in via SSO on their next attempt.
For further assistance, contact Fabric Support and include the exact error message and a screenshot.