SSO (Single Sign-On) is a service that allows users to log in to different platforms using a single set of credentials.
With SSO, your students don't need a separate user account to access your online site and your LearnWorlds school. They can use their existing login system of your built-in site under one set of identity-verifying user credentials and securely access your LearnWorlds school too.
In LearnWorlds you can enable multiple custom SSO solutions simultaneously. You will find more information in this article.
What is SAML
Security Assertion Markup Language (SAML) 2.0 is one of the most widely used open standards for authentication and authorization between multiple parties. It’s one of the protocols that give users the single sign-on (SSO) experience for applications.
At its core, Security Assertion Markup Language (SAML) 2.0 is a means to exchange authorization and authentication information between services. SAML is frequently used to implement internal corporate single sign-on (SSO) solutions where the user logs into a service that acts as the single source of identity which then grants access to a subset of other internal services.
Advantages:
- Single source of identity.
- Enforce consistent authentication. SAML/SSO can be used to enforce a consistent method of authentication across all internal corporate services, like multifactor authentication and session duration.
How does SAML work with your School?
Once you set up SAML SSO with your existing IDP, your users will be able to Single Sign-On to your school via your Identity Provider (IDP).
For instance, we have set up the following demo school to use Okta as IDP:
When the user clicks on Sign in and they are not already logged in to their Okta account then they will be redirected to Okta in order to be authenticated:
Okta will redirect them back & logged in to the LearnWorlds school page upon successful authentication.
If the user is already logged in to their Okta account, then they will be automatically logged in to Learnworlds.
Finally, the SSO mechanism is using the user’s email to identify the user, therefore, to change the user's email address you will need to update the new email both in your school and on your IDP.
How to set up SAML
You may set up SAML practically with any Identity Provider (IDP). IDPs will give you the option to create an authentication application that you will need to provide the necessary information from your school (the Service Provider) and you will also need to gather the necessary information from the IDP’s authentication application.
We have already created detailed guidelines for the following IDPs:
If you have another IDP, then you can refer to your IDP documentation and go to our setup page.
You can allow your users to use the SAML solution of your preference to sign in/up in your school without the need to re-enter their username and password.
1. In your LearnWorlds school go to Website → Website settings → Authentication and select SAML.
2. Add a new SAML
3. Activate SAML and add a name for this SAML solution.
4. Once you set up this information on your IDP and create the authentication application, you will need to update your school’s setup with the necessary information from your IDP:
a. IDP Identifier (Entity ID): this is the given IDP id for the created application.
b. Sign-on URL: this is the URL that the school will call to authenticate the user via the IDP.
c. Single Logout URL: in case you implement a single logout you may provide this URL. When the user logs out from Learnworlds the system will call this URL and the IDP will log out the user from all other Services.
d. Identity Provider Certificate: you need to pass the public certificate to authenticate the call.
e. Service Provider (SP) URL: it is your school SAML Service Provider (sp) URL that the IDP will use to identify your service.
f. Assertion Consumer Service (ACS) URL: this is the “Reply URL” that the IDP will use to inform your school (SP) if the user has been authenticated successfully.
g. Single Logout URL: The URL that will be used by the identity provider, to inform the service provider (your school) in case the user should be logged out; please paste this value to your identity provider, if needed.
h. Create User: Adds a new user to the school, if a user with this email does not already exist.
5. Click on Create to save your settings and you are all set. Your users may now Single Sign-On by using your favorite IDP.
If you're using SAML as an authentication method, it's mandatory to change the Site Navigation settings in the Payment Flow section for Logged-out users, as they will need to sign up/log in before proceeding to the payment page.
Also, you need to ensure that in all Payment Sections of your school's pages, 1-click Sales funnels, or the Payment Page of your school, the Sign in/up form option is set to hide since the user will not be able to sign in/up via the Learnworlds system.
Notes:
- You need to use the LearnWorlds admin (school owner) account, to set up a Custom SSO URL or SAML for your LearnWorlds school; in case you misconfigure your setup, then only this account will be able to sign in to your school. Hence all the changes in the Sign in/up page regarding SSO will have to be made by the LearnWorlds admin.
- Only the Sign in link should be used at your school since Sign Up and password reset will be performed by the IDP.
- If you wish to use our built-in Affiliate Management program, you should consider not using the SSO solution, since it will not be feasible to use this feature and track sales.
- If you enable SAML (external IDP), the LearnWorlds password update/reset functionality will not be available.
- If you want to use more than 3 custom SSO solutions please contact us at support@learnworlds.com.