Hello there!
Need Help? We are right here!
Need Help? We are right here!
Thanks for your Enquiry. Our team will soon reach out to you.
If you don't hear from us within 24 hours, please feel free to send a follow-up email to info@xecurify.com
Search Results:
×Multiple brands allow you to deliver multiple branded authentication experiences from a single tenant. Each brand can have its own theme, labels, domains, endpoints, and branding preferences while sharing the same users, applications, authentication policies, and security settings.
This enables organizations to provide unique authentication experiences for different business units, subsidiaries, customers, or partner organizations without deploying separate tenants.
A brand customizes the appearance of the pages your users interact with, including the hosted sign-in page, error pages, and the end-user dashboard. A brand acts as a presentation layer over your tenant and does not modify authentication behavior or tenant configuration.
Every tenant starts with a default brand. You can customize its appearance by configuring logos, favicons, colors, labels, and other branding settings. For detailed instructions on configuring the default brand, refer to the Branding and Customization guide.
Branding changes only the user experience. Your users, applications, authentication methods, and access policies remain shared across all brands within the tenant.
Multi-brand customization lets a single tenant present multiple, independently themed experiences across multiple domains. Instead of provisioning a separate tenant for each brand — the traditional workaround for multi-tenant branding — you manage every brand from one tenant that shares a single user store, a single set of applications, and a single policy set.
Each brand is bound to a domain. When a request arrives, miniOrange resolves the domain to a tenant and a brand, and renders the pages with that brand's assets and custom code.
Every brand you create is served on its own custom domain — your own DNS name (for example, login.org.com) pointed at miniOrange. Custom brands are served on custom domains, as described in Set up a custom domain.
The default brand is the exception: it is served on your organization's Xecurify subdomain.
Each custom domain maps to exactly one brand.
Brand resolution is driven entirely by the request's host. A request that arrives on a brand's custom domain is served with that brand's theme; a request on your organization's Xecurify subdomain is served with the default brand.
Because resolution keys off the host, the same authentication flow presents different branding depending on which domain the user arrives on, while signing them into the same tenant.
Before a brand can be served on a custom domain, the domain has to be registered with miniOrange, aliased to your tenant over DNS, and provisioned with a TLS certificate. Certificate provisioning is completed by the miniOrange team from the material you supply.
Prerequisites:
miniOrange serves custom domains over HTTPS, so a valid certificate for the exact domain is required.
login.org.com. This registers the domain against your tenant.org.xecurify.com; use the exact target for your organization.| Type | Host/Name | Value/Target |
|---|---|---|
| CNAME | login.example.com |
org.xecurify.com |
idpsupport@xecurify.com. The miniOrange team uses them to provision TLS termination for the domain and complete the setup on the platform side. Send the private key over a secure channel — for example, as an encrypted or password-protected attachment.Open the custom domain in a browser — for example, https://login.org.com. The branded sign-in page should load over HTTPS with a valid certificate. If it doesn't, confirm the CNAME resolves to your Xecurify subdomain (a DNS lookup tool such as dig or nslookup helps here) and allow additional time for propagation.
Public certificates expire. Because the certificate is provisioned by the miniOrange team from the material you provide, send an updated private key and certificate chain to idpsupport@xecurify.com ahead of the expiry date to avoid an interruption on the custom domain. Confirm the exact renewal lead time and handoff with the miniOrange team.
Each brand can override the following, independently of every other brand in the tenant:
Customizations are declarative and isolated to the brand. Editing one brand never affects another, and none of these changes touch authentication behavior.
Brand management — creating brands, managing domains, uploading assets, and brand settings — is done in the Admin Console under the Branding tab.
Branding only customizes the user experience. Your user store, applications, authentication policies, MFA settings, and other security configurations are managed at the tenant level and are shared across all brands. A brand does not determine which applications a user can access or which policies apply. Instead, it only controls the look and feel of the user-facing pages. Access and authentication are governed by the tenant's configuration.
The Metadata/Endpoints tab in the application edit window displays the endpoint URLs/SAML metadata required to integrate your application. By default, the metadata and endpoints for your organization's Xecurify subdomain are displayed. If you want to integrate SSO with a specific brand, then select the Custom Domain associated with that brand from the dropdown and view the corresponding metadata/endpoint URLs generated for that custom domain.
When an application uses miniOrange as its Identity Provider in the SSO flow, users are authenticated through the domain where the authentication request is initiated. If the request is sent to a brand's custom domain, miniOrange displays the sign-in experience configured for that brand, including its theme, logo, and other branding elements.
The brand is automatically selected based on the custom domain used in the request, as described in How brand resolution works.
When miniOrange acts as an identity broker in the SSO flow, it authenticates users through an external Identity Provider while maintaining the branded experience.
If the authentication request is initiated using a brand's custom domain, miniOrange automatically uses that same custom domain when generating the endpoints sent to the external Identity Provider.
redirect_uri (callback URL) sent to the external provider uses the brand's custom domain.Because these endpoints are generated using the brand's custom domain, they must be registered and trusted by the external Identity Provider. Ensure that the brand's ACS URL (for SAML) and redirect/callback URIs (for OAuth, OpenID Connect, and JWT) are added to the external Identity Provider's list of allowed URLs. Otherwise, the external provider will reject the authentication response or callback.