Adding and using ISV Identity Providers

ISV Identity Providers

ISV Identity Providers lets an ISV register its organisation’s external OpenID Connect provider so users can sign in to Visma applications with their corporate accounts. Registration makes the provider available for applications to select; each Visma application must still enable it separately in that application’s policy.

Enable IdP access by Partner Administrator

A Partner Administrator enables Identity Providers for an ISV and selects one or more Visma business units. At least one business unit is required. Only applications owned by the selected business units can enable the ISV’s providers in their application policies.

Partner Administrators can view registered providers and change their display names, but the ISV owns the technical configuration. Partner Administrators cannot edit that configuration or delete a provider. Disabling access is blocked while the ISV’s own applications use a provider in their policies.

Register a provider by an ISV

When access is enabled, ISV administrators with the External Developer or Team Manager role can open My IdPs and register one provider. The registration form requires an HTTPS Authority URL that exposes OpenID Connect discovery metadata, a Client ID, and an authentication flow.

The available flows are:

Web: confidential web flow; requires a client secret.

PKCE: Proof Key for Code Exchange; does not require a client secret.

Web + PKCE: supports both flows; requires a client secret.

After saving, Visma Connect provides the provider’s redirect and sign-out redirect URIs. Configure those URIs in the external provider. The client secret is sent to Visma Connect and is not displayed again in the portal; it can be replaced through the secret-rotation action.

Client secret cand be changed from the Rotate link visible both in edit and read only mode.

Manage a provider

A new provider starts in Draft and cannot be used by applications until enabled. ISV administrators can edit its technical configuration, enable or disable it, and delete it. Disabling prevents applications that have not already enabled it from selecting it; existing application configurations remain in place. Deletion is blocked while any application uses the provider.

Partner Administrators can review the provider’s status and read-only configuration details, and rename it. The display name appears to users on the sign-in page.

Application policy Identity Providers

If an application has the same Business Unit(in application details tab) as the one that the Partner Administrator has set for the ISV who created the Idp, then, that application will  have the enabled Idps in the list under the new category ISV external IdP