One sign-in for staff, and a workable one for everybody outside the company.
SSO and identity for industrial B2B covers two connected problems. Internal staff in engineering, sales, marketing and service should reach the website’s protected areas with the corporate credentials they already hold, through SAML or OpenID Connect against Microsoft Entra ID, Okta, Google Workspace or an on-premise directory, so access is granted and revoked by the process your IT function already runs.
The harder half is external. Distributors, dealers, installers, specifying engineers and service partners are not in your corporate directory and will not be added to it. They need an invitation and approval route the channel team owns, per-account administration so a distributor manages its own people, periodic re-verification, and group membership that decides what each of them sees: net pricing at the right tier, CAD files and manuals, order history for their own account, and only the territories and product lines that belong to them.
Most industrial websites end up with something behind a login: a distributor portal carrying net pricing, a documentation area holding CAD files and manuals, a service partner area with warranty procedures, an internal tool the sales team opens on a customer visit. Each tends to arrive with its own user table and its own password reset. SSO and identity for industrial B2B replaces that with one model of who a person is, which organisation they belong to, and what that membership entitles them to see.
Single sign-on against your existing identity provider for internal staff, an invitation, approval and re-verification route for external users that the channel team can operate without involving IT, group and role membership driving entitlement, territory and product-line restrictions, session policy set to the sensitivity of what sits behind the login, and an access record that answers who could reach what, and when.
Where a corporate identity provider is in place, whether Microsoft Entra ID, Okta, Google Workspace or a provider fronting an on-premise directory, the website federates to it instead of holding its own passwords. Staff sign in with the credentials they already use, multi-factor and password policy stay enforced centrally by IT, and there is one fewer credential store for a security review to account for. Group claims from the directory map to roles on the site, so a change made in the directory reaches the website without a second administration step. See website security for how access control sits inside the wider hardening work.
The practical value of federating is that access follows employment. When someone joins, membership of a directory group grants portal access at first sign-in. When someone moves from field service into sales, the group change alters what they can reach. When someone leaves, disabling the account centrally closes the website the same day, without anyone having to remember that a separate user list exists. That last case is where site-local accounts usually fail: they survive the offboarding process because no step in it points at them.
A distributor’s sales manager, an authorised installer, a specifying engineer in a customer’s design office: none are in your directory, and adding them is neither practical nor something your IT function would accept. They need their own route in. An invitation issued by the channel or sales team, an approval step with its decision recorded against the account, and a periodic re-verification so a list assembled over ten years does not quietly become a list of people who have moved on. Where a distributor is large enough, per-account administration lets its own administrator add and remove its people, so the work does not land on your channel team. See distributor portals for how that sits inside a wider portal.
A login that admits everyone to the same content solves very little. Group and role membership decides what a given user sees: a dealer tier resolves to a net price list, a specifying engineer reaches drawings, models and manuals but not commercial terms, a procurement lead reaches order history for their own account and no other. Territory and product-line restrictions apply on top, so a distributor covering one region does not browse another’s pricing. Those rules come from your commercial policy; we implement them and test each one. See technical documentation portals for the content side of it.
Code Industrial is the industrial B2B practice of Code Barcelona, an agency building corporate websites and digital platforms since 2015. The same strategy, design and engineering team works on every industrial project, from the first scoping session through to life after launch.
Internal staff and external partners are different problems. SSO and identity for industrial B2B starts from that distinction.
What comes up when scoping sign-in and entitlement for an industrial site.
Two populations. Internal staff sign in through SAML or OpenID Connect against your corporate identity provider, so access follows employment. External users such as distributors, dealers, installers and specifying engineers arrive through an invitation and approval route your channel team owns, with delegated administration and periodic re-verification. Group membership then decides entitlement: pricing tier, technical documentation, order history, territory and product line.
Yes, and connecting to the provider you already run is the preferred approach. We integrate over SAML or OpenID Connect, so staff use existing credentials while your multi-factor and password policy stay enforced centrally. Group claims map to site roles, which means a change made in the directory reaches the website without a second administration step, and disabling an account closes website access the same day.
Through an invitation and approval route owned by the sales or channel team, with the approving decision recorded against the account. Where a distributor is large enough, its own administrator adds and removes its users within limits you set, including a seat cap and which roles it may assign. Accounts are then re-verified on a schedule, so the list does not quietly age past the people on it.
Yes, and that is usually the reason for having a login at all. Group and role membership resolves to what a user sees: a net price list for their tier, CAD files and manuals for a specifying engineer, order history limited to their own account. Territory and product-line restrictions apply on top. Those rules come from your commercial policy; we implement them and test each one before launch.
For staff, disabling the account in the directory closes website access the same day, because the site holds no separate credential of its own. For external users, removal is a defined step in ending a partner agreement, and the scheduled re-verification catches the individual departures that were never reported. The access record shows what an account could reach while it was active.
No. Identity is the layer deciding who gets in and what they are entitled to; the portal is what sits behind it. The two are usually scoped together, since entitlement rules and portal features shape each other, but a portal can be built on an existing identity model and one identity model can serve several properties. See portal development.
SSO and identity connects closely with these related technology pages.
Staff who need one sign-in, and a distributor network that needs a workable one. Tell us who has to get in and what each of them should reach, and we will tell you how we would approach SSO and identity for industrial B2B.