SAP Customer Data Cloud

SAP Customer Data Cloud (CDC) - the product still widely referenced as "Gigya" after SAP's 2017 acquisition - is a CIAM platform that can act as an Identity Broker, federating user authentication to upstream providers like LuxID while presenting a unified login experience to downstream applications.

Naming

SAP rebranded Gigya to "SAP Customer Data Cloud" in 2018; the legacy console URL and many community resources still say "Gigya". Both names refer to the same product. This guide refers to it as SAP CDC for clarity.

Prerequisites

• An SAP CDC site (a "Site" is the basic tenant unit; you may have multiple Sites under one CDC account)
• Site administrator access to the SAP CDC Console (opens in a new tab)
• Your LuxID Client ID, Client Secret, and the registered Redirect URI for this CDC Site
• The redirect URI follows the pattern: https://socialize.<datacenter>.gigya.com/socialize.login where <datacenter> matches your Site's data centre (eu1, us1, au1, etc.). Confirm the exact URL in your CDC admin console under Site Setup > Redirect URLs.

Reference docs: SAP CDC - OpenID Connect identity provider (opens in a new tab) | Configuring a SAML 2.0 IdP (opens in a new tab)

Add LuxID as an OIDC identity provider

1. Open the SAP CDC Console (opens in a new tab) and select your Site.
2. Navigate to Identity Access > Identity Providers > Configure > OpenID Connect (or follow the path Site Setup > Identity Access > Identity Providers depending on the console version).
3. Click Add Provider and choose OpenID Connect.

Field mapping

SAP CDC field	Value
Provider name	LuxID
Client ID	(from your LuxID registration)
Client Secret	(from your LuxID registration)
Authorization endpoint	https://login.luxid.lu/mga/sps/oauth/oauth20/authorize
Token endpoint	https://login.luxid.lu/mga/sps/oauth/oauth20/token
UserInfo endpoint	https://login.luxid.lu/mga/sps/oauth/oauth20/userinfo
JWKS URI	https://login.luxid.lu/mga/sps/oauth/oauth20/jwks/OIDC-LUXID
Scope	openid profile email
Response type	code

Under Mapping (the "Field Mapping" panel that opens after saving the provider), map LuxID claims to CDC user-profile fields:

LuxID claim	CDC profile field
sub	loginIDs.emails[0] (LuxID uses email as primary identifier; CDC stores it in loginIDs)
email	profile.email
given_name	profile.firstName
family_name	profile.lastName

Save the provider. CDC may prompt you to publish the change to the live Site.

JIT account behaviour

By default, SAP CDC creates a new user record in the CDC user store on first LuxID authentication (JIT provisioning). If a user already exists in CDC with the same email, CDC's "Link Accounts" policy decides whether to link the LuxID identity to that existing account. Review Identity Access > Login Identifiers > Account Linking before going live - the wrong setting can either duplicate accounts or merge unrelated ones.

Test login

1. Open your CDC test page or a downstream app's login URL.
2. Click Sign in with LuxID (the CDC standard "Social Login" widget exposes the configured OIDC providers as login buttons).
3. Authenticate against login-uat.luxid.lu with your sandbox account.
4. Verify a CDC user is created or linked, and that the profile fields populate from the LuxID claims.

Common pitfalls

• Redirect URI host mismatch: the redirect URI must match the CDC data centre of your Site. Use eu1, us1, etc. - not just socialize.gigya.com.
• Wrong API key in URL: CDC's "Site API Key" is part of internal URLs but is not the LuxID Client ID. Keep them separate.
• Field mapping not published: changes to mapping must be explicitly published to the live Site. Test in CDC's staging mode first.
• Token-lifetime mismatch: CDC's session tokens have their own lifetime independent of LuxID's. Set CDC session lifetime to match (or be shorter than) LuxID's refresh-token lifetime for a consistent experience.