Skip to content
  • There are no suggestions because the search field is empty.

Login Methods and Configuration

Originality supports several login methods, which administrators configure directly on the license. This article explains the available methods, how to set each one up, and how automatic user provisioning works.

In this article:

How login works in Originality

Originality is available at https://wiseflow-originality.net. Access to the platform is controlled by two things:

  1. A login method – how a user authenticates. Administrators decide which methods are available on the license.
  2. A user record with a role – authenticating proves who someone is; a role determines what they can do. A user who signs in successfully but has no role assigned will not be able to use the platform. See User Management.

You can have multiple login providers active at the same time. Users then choose which method they want to use on the login screen. This is useful during a transition – for example, keeping Magic Link available for a small group of administrators while rolling out institutional single sign-on to assessors.

You can also add more than one provider of the same type. This matters for institutions that need to authenticate several distinct user populations against one Originality license – for example two Microsoft Entra tenants following a merger, or several WAYF institutions sharing a single license. Where you do this, give each provider a clear Display Name so users can tell them apart on the login screen.

Login providers are configured per license under Settings > Login.

Note! Configuring login methods requires the administrator role in Originality.

Available login methods

Method What it is Typical use
Magic Link A one-time sign-in link sent to the user's email address. Always available and cannot be removed. Getting the first administrator into the platform, and as a fallback if single sign-on is unavailable.
Microsoft Entra Single sign-on against your Microsoft Entra tenant. Institutions whose identity platform is Microsoft Entra (formerly Azure AD).
OpenID Connect Single sign-on against any OpenID Connect compliant identity provider. Institutions using an identity provider other than Entra or WAYF.
WAYF Single sign-on via the WAYF federation. Danish institutions that are members of WAYF.

Magic Link is listed as Always available and has no configuration options. The other three are added and configured by an administrator.

Before you start

For any of the single sign-on methods, you will need someone who can administer your institution's identity provider. Gather the following before you begin:

  • For Microsoft Entra: your Tenant ID.
  • For OpenID Connect: the discovery endpoint, a Client ID, and a Client Secret from an application registered in your identity provider.
  • For WAYF: confirmation that your institution is a WAYF member, and the correct institution entry to select.

You will also need to register Originality's Callback URL in your identity provider as an allowed redirect URI. The Callback URL is shown in the provider configuration dialog in Originality, with a copy button beside it.

Note! Treat the Client Secret as a credential. Transfer it securely and do not send it by email or chat.

Adding a login provider

  1. In Originality, go to Settings > Login.
  2. In the Login Providers section, click + Add provider.
  3. Select the provider type you want to add from the list.
  4. Complete the fields in the dialog (see the sections below for each provider).
  5. Click Save.

The provider now appears in the Login Providers list and becomes selectable for users on the login screen.

Each provider has an optional Display Name. This is the name your users see when choosing a login method, so it is worth setting it to something they will recognize – for example, your institution's name rather than the technical protocol. If you leave it blank, Originality uses the provider's default name.

Note! Display Name becomes important as soon as you add two providers of the same type. Two providers both left blank will both appear as WAYF, or both as Microsoft Entra, giving users no way to choose correctly. Name them after the institution, campus or tenant they serve.

Configuring Microsoft Entra

  1. Go to Settings > Login and add or edit the Microsoft Entra provider.
  2. Optionally set a Display Name. Defaults to Microsoft Entra if left blank.
  3. Enter your Tenant ID. This is required.
  4. Optionally open Advanced to adjust scopes or claim names (see Advanced settings).
  5. Click Save.

The dialog includes a Where do I find my Tenant ID? panel linking to Microsoft's own documentation, which explains how to locate the Tenant ID in the Azure portal.

Configuring OpenID Connect

Use this option if your identity provider is not Microsoft Entra or WAYF, but supports OpenID Connect.

  1. Go to Settings > Login and click + Add provider > OpenID Connect.
  2. Optionally set a Display Name. Defaults to OpenID Connect if left blank.
  3. Enter the Discovery Endpoint – your provider's OpenID configuration URL, in the form https://example.com/.well-known/openid-configuration. Required.
  4. Enter the Client ID from the application you registered in your identity provider. Required.
  5. Enter the Client Secret. Required. Use the eye icon to reveal what you have typed if you need to check it.
  6. Copy the Callback URL shown in the dialog and add it as an allowed redirect URI in your OpenID Connect application. The field is read-only – use the copy button beside it.
  7. Optionally open Advanced to adjust scopes or claim names (see Advanced settings).
  8. Click Save.

Note! If the Callback URL is not registered in your identity provider, users will be redirected back from the provider and the sign-in will fail. Register it before testing.

Configuring WAYF

WAYF is a Danish identity federation. Use this method if your institution is a WAYF member.

  1. Go to Settings > Login and click + Add provider > WAYF, or click the pencil icon on an existing WAYF provider.
  2. Optionally set a Display Name. Defaults to WAYF if left blank.
  3. Under Your institution, start typing your institution's name. The field searches by name across all WAYF institutions. Select the correct entry from the results. This is required.
  4. Click Save.

To change the institution on an existing WAYF provider, open its settings, click Remove next to the current entry, then search for and select the correct one.

Magic Link

Magic Link is always available on every license and requires no configuration. When a user chooses it, Originality emails them a one-time sign-in link.

Magic Link is the practical way to get your first administrator into the platform before single sign-on is configured. Because it cannot be removed, it also remains available as a fallback if your identity provider is temporarily unreachable.

Note! Bear in mind that access still depends on the user having a role. If automatic user provisioning is disabled, only users who already have an account can sign in with Magic Link.

Advanced settings: scopes and claims

Both Microsoft Entra and OpenID Connect providers include an Advanced section. You only need it when your identity provider does not return user details under the names Originality expects.

Scope is a space-separated list of the scopes required for your provider to return first name, last name and email claims. It defaults to openid profile email. Adjust it only if your provider requires different or additional scopes.

Claim name overrides let you map your provider's attribute names onto the fields Originality needs. Leave them blank to use your provider's defaults:

Field Default claim
Email email
First name given_name
Last name family_name

If users are created after sign-in but their name or email is blank or wrong, these settings are usually the cause.

User provisioning

The User Provisioning section on the Login tab controls what happens the first time somebody signs in successfully.

Automatic user provisioning on first login. When enabled, Originality creates a user account automatically the first time a user signs in. When disabled, only pre-created user accounts can sign in – anyone else is refused, even if they authenticate correctly with your identity provider.

Default role on first login. The role automatically assigned to a user created on first login. The available options are none, assessor and admin. This setting requires automatic user provisioning to be enabled.

Choosing between these depends on how much control you want:

  • Provisioning enabled, default role none. Users appear in your user list after their first sign-in attempt, and an administrator assigns a role before they can work. This keeps a deliberate approval step and is a sensible default for most institutions.
  • Provisioning enabled, default role assessor. Users get working access immediately on first sign-in. Convenient at scale, but everyone who can authenticate through your identity provider gains access.
  • Provisioning disabled. Administrators create every account manually in advance. The most controlled option, and the most work.

Note! Take care before setting the default role to admin. Every user who signs in for the first time would receive full administrator rights over the license, including access to all documents on the license and to user management.

Editing or removing a login provider

In the Login Providers list, each configured provider has two actions:

  • The pencil icon opens its settings so you can change them.
  • The bin icon removes the provider from the license.

Magic Link has no action icons – it is always available and cannot be edited or removed.

Removing a provider stops users signing in with that method. It does not delete their user accounts, and any documents they have uploaded are retained. If those users have no other available login method, they will lose access until you add one.

Note! Before removing your only single sign-on provider, check that you can still sign in as an administrator another way – for example via Magic Link – so you do not lock yourself out of the license settings.

Troubleshooting

Symptom Likely cause What to do
User authenticates successfully but cannot use the platform No role assigned Assign a role on the User Management page. See User Management.
User signs in but no account is created Automatic user provisioning is disabled Enable provisioning, or create the account manually in advance.
Sign-in fails on return from the identity provider Callback URL not registered as an allowed redirect URI Copy the Callback URL from the provider dialog and add it in your identity provider.
User account is created but the name or email is missing or wrong Scopes or claim names do not match your provider Check Advanced > Scope and Claim name overrides against what your provider returns.
Users see an unfamiliar login button Display Name not set, or set to a technical name Set a Display Name your users will recognise.
Two identical buttons on the login screen Two providers of the same type with no Display Name set Give each provider a distinct Display Name.
WAYF sign-in reaches the wrong place Incorrect institution selected Open the WAYF provider settings and confirm the correct institution is selected.
Magic Link email does not arrive Delivery delay or spam filtering, or no matching account Ask the user to check their spam folder. If provisioning is disabled, confirm an account exists for that email address.