Single Sign-On (SSO) Documentation

Setup SSO with SAML 2.0

Contents

• Providers
• Set-up instructions
  • Company ID/ Business ID
  • SSO URL
  • SAML Entity ID
  • SAML Certificate
• Sync employee information with custom fields
• Single Log Out (SLO)

Last updated 28 November 2023

Why set up single sign-on?

Single sign-on (SSO) allows EdApp to identify users through an external Identity Provider (IDP).

Instead of manually registering learners, users are directed to their company identity portal, fill in their company login details, and are redirected back to EdApp. This enables a user to log in to multiple systems via a single portal. On EdApp's side, a user is internally created to match the user's details sent back from the IDP.

Providers

We provide support for SAML 2.0 based SSO integrations.

This includes:

- Active Directory

- Google

- Okta (SCIM available)

- OneLogin

- Salesforce

- Auth0

- Ping Identity

- All other systems that use SAML 2.0.

Set-up instructions

Step 1: Go to the EdApp LMS (admin.edapp.com) with the ‘Single Sign-On’ button in the top right.

Step 2: Click on the Connect with SAML

Step 3: Once you have a SAML IDP set up, you can fill in the relevant details on this page, which will enable SSO for your users.

Company ID/ Business ID 

The company ID (on the admin portal) or business ID (on the learner's app) can be anything you want. Company ID and business ID are interchangeable terms on EdApp.

You must ensure this matches what you've used in your specific IDP, i.e. if you use "acmeventures" in the company ID in EdApp, make sure it's also "acmeventures" in your SSO provider.

The company ID is also used to identify your account in EdApp when your IDP calls our API to authenticate the user. The ACS (Reply) URL field in your IDP specifies the endpoint in EdApp. The format in your IDP is https://api.edapp.com/sso-saml-callback/{COMPANY-ID}

If your company ID in EdApp is "acmeventures", your ACS (Reply) URL in your IDP would be https://api.edapp.com/sso-saml-callback/acmeventures

SSO URL

This URL will be available in your IDP under the ‘Login URL’ field.

Below is an example from Azure.

SAML Entity ID

Your entity ID must match the entity ID for this configuration in your IDP e.g you can use https://web.edapp.com/{companyID}. 

You can replace company ID above with your organization's company ID e.g. https://web.edapp.com/acmeventures

SAML Certificate file

Depending on your IDP, you may need to add a certificate file for your SSO to function. This should be provided by your IDP. Consider adding a certificate file even if your IDP doesn’t enforce it to enhance the security of your application.

User Synchronization

Users are created in EdApp as soon as they log in to our system using SSO. In the event you wish to create the users in EdApp before they log in with SSO, that can be done through our LMS, SCIM with Okta and with our public API. If a user exists in the system with the same email address as the user signing in through SSO, EdApp will treat them as the same user.

Sync employee information with custom fields

You can send additional information about your learners via custom fields including job title, first name, last name, active status or any custom fields you'd like.

You'll need to map your "Claims" in the IDP to the "Custom fields" in EdApp.

Below is an example in Azure AD for a claim that populates the jobtitle field.

The next step is to create the custom field in EdApp via the admin portal:
https://admin.edapp.com/app-settings#panel-user-custom-fields

In EdApp, this would look like the below:

The fieldname should match the claim in the IDP.

This custom field data can then be used to automate user management through dynamic user groups. You can create criteria based rules on dynamic user groups to automatically assign learners to courses based on their information. Read more on dynamic user groups here.

Single Log Out

In EdApp we support single log out where the user is logged out of EdApp automatically when they log out of your organization's IDP. In your IDP, the logout URL should be like:

https://api.edapp.com/sso-logout/{COMPANY-ID}