SSO lets you sign in once and move between connected systems without signing in again. Instead of a separate username and password for every application, you authenticate with one trusted provider, and that identity works across everything you’re allowed to access. For enterprise buyers reaching a supplier’s portal, it means walking straight in with the login they already use at work. No forgotten passwords, no extra account to manage, no friction.

You connect your website to the identity provider your clients already use — Okta, Microsoft Entra ID, Google Workspace, Ping, whoever they trust. Both sides agree on a protocol (SAML or OpenID Connect), exchange a handful of configuration details — sign-in URLs, certificates — and from then on, when someone signs in, the provider vouches for them. GetConnect handles this end-to-end for e-commerce sites. You’ll need a GetConnect Hub license as the base platform, and we take it from there.

GetConnect supports the identity providers most enterprise clients actually use: Okta, Microsoft Entra ID (previously Azure AD), Google Workspace and Ping. Because these work through shared standards — SAML and OpenID Connect — we can often connect to others too. If your clients use a provider that isn’t listed here, ask anyway. Support usually comes down to the protocol it uses rather than its name, and the GetConnect team can confirm for your setup.

Okta acts as the identity provider, your e-commerce site acts as the application. You create an application entry in Okta, choose a protocol (SAML or OpenID Connect), and exchange configuration details — the sign-in URL and a certificate or client secret — between Okta and your site. GetConnect handles this for e-commerce portals, so users in your clients’ Okta directories can sign in with their existing Okta credentials. Once it’s set up, adding or removing a user is done in Okta, and their access to the portal follows automatically.

Microsoft Entra ID (previously Azure AD) works as the identity provider. You register your e-commerce site as an application in Entra ID, pick a protocol — SAML or OpenID Connect — and share the sign-in and certificate details between Entra ID and the site. GetConnect connects e-commerce portals to Entra ID so people in your clients’ Microsoft directories can sign in with their usual work accounts. Because so many organisations already use Microsoft 365, Entra ID is one of the most common providers we’re asked to connect.

“Azure SSO” usually refers to Microsoft Entra ID, which was renamed from Azure Active Directory (Azure AD) in July 2023. Microsoft brought it under the broader Entra family of identity products, but the service itself — its features, licensing, capabilities — stayed exactly the same. The integration works the same way: your site is registered as an application in Entra ID, connected using SAML or OpenID Connect, configuration details are shared, and users can sign in with their Microsoft work accounts. If your organisation still calls it Azure AD, that’s the same directory.

Google Workspace acts as the identity provider, letting users sign in with their existing Google work accounts. You set up your site as a connected application in the Google Admin console, choose SAML (or OpenID Connect where supported), and exchange the sign-in URL and certificate details between Google and the site. GetConnect connects e-commerce portals to Google Workspace so staff in your clients’ Google directories reach the portal without a separate login. Access is then managed from the Google Admin console, right alongside their other Google services.

Ping (PingFederate, PingOne) acts as the identity provider. Your e-commerce site is set up as a connected application within Ping, using SAML or OpenID Connect, and the two sides exchange the details they need to trust each other. GetConnect connects e-commerce portals to Ping so users in your clients’ Ping directories can sign in with credentials they already hold. Ping is common in larger enterprises with more detailed access requirements, which is why we’re regularly asked about it.

SAML (Security Assertion Markup Language) is a protocol, not a provider. It’s the shared language that many identity providers — Okta, Entra ID, Google Workspace, Ping — use to pass identity information securely to a website. When a user signs in, the identity provider sends a signed “assertion” confirming who they are, and the website trusts it. Because SAML is a standard, GetConnect can connect to most providers that support it, even ones not listed by name. In practice, you exchange a small set of details — an entity ID, a sign-in URL, a signing certificate — between the provider and the site. If your provider supports SAML, that’s usually enough to make a connection work.

Magento 2 (Adobe Commerce) can be connected to an identity provider so enterprise buyers sign in with their existing company credentials, not a separate Magento account. This is done by adding SSO to the store and pointing it at the provider your clients use, through SAML or OpenID Connect. GetConnect adds SSO to Magento 2 stores and connects them to identity providers like Okta, Entra ID, Google Workspace and Ping. You’ll need a GetConnect Hub license as the base platform, then the SSO product manages the sign-in connection for the store.

WordPress — often running WooCommerce — can be connected to an identity provider so users sign in with their existing company accounts, not a separate WordPress login. The site is set up to trust the provider, using SAML or OpenID Connect. GetConnect adds SSO to WordPress sites and connects them to the identity provider your clients already use. This runs on a GetConnect Hub license, with the SSO product managing the connection between the site and the provider.

User attributes are the pieces of information an identity provider sends about a person when they sign in — email address, staff ID, department, role. These attributes can be mapped to fields on your e-commerce site, so the right details follow the user in automatically. A common example is linking a staff ID to an email address, or passing a user ID through so orders can be tied to the correct person in your accounting system. GetConnect maps the attributes your provider sends to the fields your store needs, so information stays consistent between systems. If there’s a specific attribute your clients rely on, it can usually be included.

With SSO, most user management happens in the identity provider, not on the website. Adding, removing or grouping users is done centrally, and their access to the portal follows from there. This is why larger organisations favour SSO — control stays in one place. On the store side, users signing in through SSO can be organised into groups, and access can be shaped for those groups — for example, allowing certain staff to see particular areas of a portal. GetConnect sets up these groups and restrictions so the right people reach the right parts of the site. If access needs to differ between teams within a client’s organisation, that can be built in from the start.

Because SSO tells the website who a user is and which organisation they belong to, that information becomes your signal for what they should see. Show specific products or categories, hide items that aren’t relevant to a particular client, apply agreed pricing and discounts for a given organisation. A buyer from one company might see their own negotiated prices and a product range built for them. Another company sees something completely different. GetConnect uses the details passed through SSO to shape this experience per organisation. If your clients expect their own tailored view, that’s built into the design.

For businesses selling across countries or regions, SSO carries the information needed to give each user the right experience. Based on the organisation or location details passed at sign-in, a user can be routed to the correct regional site and shown settings that match their region. GetConnect connects multi-region setups to your clients’ identity providers and uses the details from sign-in to place each user in the correct regional context. This works alongside routing users to the correct website, and regional settings like language and currency all follow from there.

The information passed at sign-in — organisation, country, region, whatever your provider sends — becomes your signal for what a user should see. A buyer from Paris sees prices in EUR and content in French without being asked. Someone from Tokyo gets JPY and Japanese. GetConnect maps those details to your store’s language and currency settings, so defaults land right the first time. If your clients span multiple regions and you’re tired of everyone having to click through a language selector, this is how you stop.

Purchase order payment lets a buyer place an order against their company’s account and pay through an agreed invoicing process, rather than entering card details at checkout. It’s standard in B2B buying — procurement and finance handle payment separately from the person placing the order. Because SSO identifies the user and their organisation, it can be used to enable PO payment for the right buyers. Show a “pay by purchase order” option only to approved companies. GetConnect connects SSO to PO payment so approved buyers check out against their account. If your clients buy on account rather than by card, this can be built in.

Here’s the clearest way to think about it: SSO is who you are, PunchOut is how you buy. With SSO, a user reaches your site using the credentials they already have, no new account needed. With PunchOut, a buyer starts inside their own procurement system (SAP Ariba, Coupa, whatever their company runs), clicks “shop here”, builds a basket on your site, and that basket goes back into their procurement system for approval and payment. SSO handles identity. PunchOut handles the buying journey. Many large clients use both, because they solve different parts of the problem.

PunchOut lets a buyer’s procurement system open your online catalog in a secure session, so the buyer can browse live products and prices, fill a shopping cart and send it back to their system as a requisition, without re-keying anything. GetConnect Hub sits in the middle: it accepts the PunchOut session from the buyer’s system, signs the user into your store or back-office system, translates the returned cart into the format the buyer expects, and then handles the resulting purchase order, advance ship notice and invoice.

GetConnect Hub supports SAP Ariba, Coupa, JAGGAER, Ivalua, Oracle, SAP (via OCI), Tungsten and any other procurement platform that uses the cXML or OCI standards. Single Sign-On (SSO) systems such as Okta, Microsoft Entra ID and Ping Federation are also supported, using SAML or OAuth. If your customer’s system is not on that list, arrange a call and we will check the connection method they support.

A Level 1 catalog sends the buyer out to your own website or portal to shop, so you keep full control of live pricing, stock levels and product information and only need to maintain it in one place. A Level 2 catalog loads products directly inside the procurement system, which can feel slightly quicker for a very small product range but means the catalog must be kept in sync in every buyer’s system. Most GetConnect Hub customers choose Level 1, often with separate tiles for different purposes such as a standard store and a custom-order or quote tile.

We use a short client questionnaire covering four areas: sign-on (which system and protocol, and which user details can be sent), requisitions (what is returned on the cart, such as tax, shipping and UNSPSC codes), purchase orders (countries, currencies, payment terms and whether non-catalog orders are expected) and invoicing (system, tolerance and billing address rules). You will also need to supply a catalog image or tile in the size the buyer’s system requires, and for Ariba the buyer’s ANID and shared secret. Your account manager will follow up with a call if anything needs clarifying.

Yes. Ariba connects to GetConnect Hub using cXML: we need the buyer’s Ariba Network ID (ANID) and a shared secret, and we then configure the PunchOut endpoint, the catalog tile and the extrinsics that carry user details such as name, email and purchasing unit. Once live, GetConnect Hub receives the PunchOut session, returns the cart to Ariba as a PunchOutOrderMessage, and can send back cXML invoices and ship notices over the same Ariba Network relationship.

<span id=”punchout-coupa”></span>Yes. Coupa uses cXML for PunchOut, and GetConnect Hub sends the buyer’s Coupa administrator the configuration details they need to add your supplier catalog, including the PunchOut URL and credentials. From there, carts come back into Coupa as requisition lines, purchase orders arrive in GetConnect Hub, and invoices and ship notices can be returned to Coupa automatically rather than through manual entry in the supplier portal.

Yes. JAGGAER supports cXML and OCI style PunchOut, and GetConnect Hub can connect to it using the method the buyer has configured. We provide the configuration details for the buyer’s JAGGAER administrator, map the user and cost-centre data they want to pass, and handle purchase orders, invoices and shipment notices in the same way as for any other procurement platform.

Yes. Ivalua connects using cXML, and GetConnect Hub sends the buyer’s Ivalua team the configuration details to add your catalog. Ivalua has a known quirk where purchase order lines can arrive in a different order to the original requisition, so GetConnect Hub carries and matches on line numbers rather than relying on position, which keeps invoices lined up with the right PO lines.

Yes. Oracle procurement products can connect to a supplier catalog using standards-based PunchOut, and GetConnect Hub supports the cXML and OCI methods. We agree the connection method with the buyer’s Oracle team, configure the catalog tile and user details, and then handle the returned cart, the purchase order and the invoice in the usual way.

Yes. Some SAP environments use the Open Catalog Interface (OCI), where the cart is posted back to the buyer’s system as form data rather than a cXML message. GetConnect Hub supports OCI PunchOut alongside cXML, so the same catalog and order handling can serve a buyer on SAP OCI and another on Ariba or Coupa.

Yes. Where a buyer routes purchase orders or invoices through a network or dashboard such as Tungsten or the Coupa Supplier Portal, GetConnect Hub can send and receive documents using the protocol that network supports, typically cXML, XML, EDI or CSV over HTTP, FTP or SFTP. Tell us which system and protocol the buyer uses and we will confirm the right setup.

Yes. GetConnect Hub can integrate procurement PunchOut directly with business systems such as EFACS, Infor M3, Promoserve, Zigaflow, JobMGT and Promotional Office, among others, so carts, purchase orders and invoices flow straight into and out of the system you already run your business on. Orders arrive as sales orders without anyone re-keying them, and invoice and shipment data flows back out to the buyer automatically.

Yes. GetConnect Hub works with websites and e-commerce platforms including Magento, WordPress, Shopify and BigCommerce, and many others. The buyer is signed in to your site from their procurement system, shops with your live catalog and prices, and checks out by returning the cart to their system instead of paying, while the resulting purchase order comes back through GetConnect Hub to be turned into a normal order on your store.

Yes. GetConnect Hub connects procurement systems such as SAP Ariba, Coupa, JAGGAER, Ivalua and Oracle directly to your WooCommerce store. The buyer opens your shop from their procurement system, is signed in automatically, browses your live products and prices, and fills their cart as normal. At checkout, the cart is returned to their procurement system as a requisition instead of being paid for on your site, and the resulting purchase order comes back through GetConnect Hub to be turned into an order in WooCommerce.

Yes. For WooCommerce, we can prevent PunchOut users from applying discount codes, so buyers on a negotiated contract price cannot stack a public promotion on top of it. Regular customers on the same store can carry on using discount codes as usual, because the rule only applies to users who arrive through a PunchOut session.

Yes. GetConnect Hub works with Magento, so buyers on procurement systems like Ariba, Coupa, JAGGAER, Ivalua and Oracle can punch out to your Magento catalog, shop with live pricing and stock, and send their cart back to their procurement system for approval. Purchase orders, invoices and ship notices then flow between the buyer’s system and your Magento orders through GetConnect Hub, without anyone re-keying them.

Yes. If your Magento installation has more than one store, GetConnect Hub can link each PunchOut connection to a specific store within Magento. That means a particular buyer, region or purchasing unit can land in the store with the right catalog, currency and branding, while your other customers continue to use their own storefronts.

Yes. GetConnect Hub can apply custom attributes to the customer accounts it creates in Magento, and you can use those attributes to trigger specific setups. For example, an attribute can enable a particular shipping method or rate, apply a negotiated discount structure, or place the user in a customer group with its own pricing rules. The attributes can be set from the details the buyer’s system passes through, such as purchasing unit, role or region.

Yes. GetConnect Hub can connect Shopify stores to procurement systems, so an enterprise buyer can move from their Ariba, Coupa, JAGGAER, Ivalua or Oracle system into your Shopify shop, choose products at your live prices, and return the cart for approval rather than paying by card. Once the buyer’s PO arrives, GetConnect Hub passes it into your store as an order, and can send back invoices and shipment notices to the buyer’s system.

Yes. Stores connected through GetConnect Hub can be dual-purpose, whether they run on WooCommerce, Magento, Shopify or another platform. Ordinary visitors check out and pay by credit card exactly as they do today, while buyers arriving from a procurement system see a PunchOut checkout that returns their cart as a requisition instead. You keep a single catalog, a single set of product data and a single storefront to maintain, rather than building a separate site for procurement customers.

Yes. As well as WooCommerce, Magento and Shopify, GetConnect Hub works with BigCommerce and many other ecommerce platforms. If your store runs on something else, or is a custom build, get in touch and we will confirm the best way to connect it, and we can also link PunchOut directly to your ERP or CRM system if that suits your business better.

Yes. Because GetConnect Hub can integrate directly with your ERP or CRM system, or work alongside your existing website, you do not need to rebuild your store to become PunchOut capable. Where suitable, purchase orders received from a buyer’s procurement system can be delivered straight into your back-office system, and invoices and ship notices can be sent back to the buyer, without manual data entry.

Yes. GetConnect Hub can route orders using rules such as the ship-to country, so a UK delivery can go to your UK ERP or warehouse while a US delivery goes to a different system, entity or fulfilment partner. Rules are agreed with your account manager and can be as general as “all EU countries” or as specific as individual countries.

Yes. Routing can also be based on the product or product group on each order, for example sending stock items to a warehouse system, made-to-order items to a production system and custom-quote items to your sales team’s ERP. GetConnect Hub applies the rules automatically when the purchase order arrives, so each part of your business only receives the orders that are relevant to it.

Yes. GetConnect Hub can manage multiple Ariba accounts at the same time, for example separate ANIDs for different buyer subsidiaries or regions, or a mix of test and production accounts. Each account keeps its own credentials and settings, and orders, invoices and ship notices are routed back to the right account, so a single GetConnect Hub setup can serve a large global buyer with several Ariba relationships.

Yes. GetConnect Hub can combine SSO and PunchOut to enrich the user data. For example, a buyer’s Okta or Microsoft Entra ID sign-in can provide the employee’s identity and attributes, while the PunchOut session adds procurement details such as purchasing unit or cost centre. The resulting user account in your store carries both, giving you better reporting, correct pricing rules and accurate order information.

GetConnect Hub supports Okta, Microsoft Entra ID, Ping Federation and other systems that use SAML or OAuth. For SAML, we provide the Entity ID and ACS URL so your IT team can create the application, and you send back the metadata URL or file; we then configure the connection on our side.

Where the buyer’s SAML Single Sign-On system supports SCIM, GetConnect Hub can use it to create, update and remove employee accounts on your portal automatically, so leavers lose access without anyone having to remember to remove them. It is typically only relevant for SAML SSO, and the questionnaire asks whether it is available in each case.

Typically the user’s email address, first and last name, a unique employee ID, and details such as cost centre or department, role or group, and Bill-To or Ship-To addresses. These are called attributes in SAML and extrinsics in cXML. We prefer to set up individual end-user accounts for security, so email is required and a name is preferable; if a buyer does not want to share email addresses, a unique employee ID can be used instead.

Yes. Using details passed through in the PunchOut or SSO session, such as role, group, purchasing unit or region, GetConnect Hub can present different product ranges, prices or currencies to different users. For example, a US purchasing unit can be shown USD pricing while an EMEA purchasing unit sees GBP or EUR.

The cart comes back to the buyer’s system with the line items, quantities and prices, and can also include tax, shipping (usually as a separate line), product customisations, a required-by date and an 8-digit UNSPSC code for each line. The shipping address is often not included because many procurement systems only let this be set internally, and the questionnaire lets each buyer choose what to include or exclude.

Where the buyer’s system cannot lock these fields, GetConnect Hub can still check the incoming purchase order against the original quote and reject it if the price or quantity has been changed, and you can set a validity period for quotes, such as 30 days. Buyers can also add your supplier to their policy so those fields are protected, and educating users to follow one PunchOut session per purchase order avoids problems with mixed or re-used old quotes.

Yes, this can be set up, for example by allowing bulk gift card purchases through PunchOut with no ship-to address required, and by offering a link to leave the PunchOut session and switch to a credit card or gift card purchase. Gift card spending can also be blocked within PunchOut sessions if the buyer prefers, so that recipients spend their cards separately without a PO.

Yes. Some procurement systems only allow one delivery method per supplier, which means buyers’ ad-hoc or non-catalog purchase orders may arrive through GetConnect Hub too. This needs a little extra setup, and the buyer typically has to fill in the PO exactly from the quote so that the order and invoice match.

Yes. GetConnect Hub can transmit invoices in cXML to systems such as SAP Ariba, Coupa and Ivalua, or using XML, EDI or CSV over HTTP, FTP or SFTP where the buyer requires it. Invoices are built from the purchase order data and your ERP or website order, so the buyer receives an accurate electronic invoice without anyone keying it into a supplier portal.

GetConnect Hub keeps the buyer’s PO line numbers with each order line all the way through to the invoice, so the invoice references the correct line even if the order was processed in a different sequence. This matters for automated three-way matching, and it is particularly useful for Ivalua, which often sends lines in the wrong order and would otherwise cause invoices to be rejected or matched to the wrong line.

That depends on the buyer’s rules. Some procurement systems match to the penny, while others allow a tolerance, such as 5%, to cover exchange rates, shipping or tax. The questionnaire asks each buyer whether there is a tolerance and whether tax and shipping can be added at invoice stage, so GetConnect Hub can be configured to keep every invoice within their rules.

Yes. GetConnect Hub can send an ASN, also known as a ship notice or delivery notification, to the buyer’s system when goods are dispatched, including shipment tracking numbers where available. This lets the buyer’s team see what is on its way without chasing you, and can support goods-received matching in their procurement system.

Yes. The GetConnect Hub dashboard shows the orders received, invoices sent and shipment notices sent, so you can follow a document from purchase order through to invoice without logging into each buyer’s portal. Anything that has failed or needs attention is visible in the same place.

Yes. Beyond orders, invoices and ship notices, the GetConnect Hub dashboard also lists PunchOut sessions, so you can see when a buyer has opened your catalog and whether the session and the cart return succeeded. That visibility makes it much quicker to diagnose problems such as a failed sign-on, a rejected order or an invoice the buyer’s system has refused, often before the buyer has even noticed.

Possibly. Some companies block traffic to unknown websites, including supplier portals, and this can be unrestricted during testing and only become a problem once you go live. We provide a whitelist of the URLs and IP addresses that GetConnect Hub uses, so the buyer’s IT team can allow them in advance.