How to Use Salesforce with LearnWorlds OpenID Connect SSO

LearnWorlds supports OpenID Connect (OIDC) to enable seamless Single Sign-On (SSO) authentication with external identity providers like Salesforce. This integration allows users to log in to LearnWorlds using their Salesforce credentials, eliminating the need for separate login details.

This feature brings significant benefits, including:

• Enhanced security by using Salesforce as the identity provider.
• A seamless login experience without requiring multiple credentials.
• Centralized user management for administrators.
• Reduced password-related issues, improving user experience.
• Better scalability, making it easy to manage large user bases.

In this guide, we will learn how to set up a connected App in Salesforce, retrieve the necessary credentials for LearnWorlds, and finalize the OpenID Connect integration with LearnWorlds.

Connect to the Salesforce console

Open your Salesforce account and navigate to Settings → Setup.

From the left-hand menu, select App Manager.

Click on the New Connected App and choose Create a Connected App.

and enter the required details:

• Connected App Name, it should be any name that allows you to recognize that it is related to Learnworlds
• API Name
• Contact Email

Configure OpenID Connect settings

1. Select Enable OAuth Settings.

2. In the Callback URL, enter the Redirect URL from LearnWorlds (check below the steps to find it).

3. Select the relevant OAuth scopes:

• Remove the check from:
  -Require Proof Key for Code Exchange (PKCE)
  -Extension for Supported Authorization Flows.
• Keep checked:

-Require Secret for Web Server Flow

-Require Secret for Refresh Token Flow

• Tick:

-Configure ID Token

-Include Standard Claims
-Include Custom Attributes

4. Click Save and Continue.

Retrieve Information to Configure LearnWorlds

1. Click on Manage Consumer Details.

2. A new browser window will open, prompting identity verification via a code sent to the registered email.

3. After verification, the Consumer Details will be displayed.

4. Copy the required information from your Salesforce account and paste it into your school. You need:

Consumer Key: This serves as the Client ID in LearnWorlds.

Consumer Secret: This serves as the Client Secret in LearnWorlds.

Discovery Document Link: Construct the link: https://[YOUR SALESFORCE DOMAIN]/.well-known/openid-configuration.

5. In your LearnWorlds school, go to Website → Website settings → Authentication and select OpenID Connect.

1. Create a new OpenID Connect.
2. Activate OpenID and add a name for this OpenID connect solution.
3. Paste the above keys and discovery link. Don't forget to fetch the discovery document link.

6. Edit the scopes, remove all the unnecessary, and keep only: email openid profile

7. Click the Create button, and the Open ID connection will be ready!

Add the Necessary Attribute in Salesforce

1. Navigate to Manage Apps → Connected Apps.

2. Find the LearnWorlds app.

3. Scroll down to Custom Attributes.

4. Add a new attribute:

• Attribute Key: name
• Mapped Field: Assign it to a relevant field, such as User.firstname.
• Alternatively, concatenate the first and last name fields.

By following these steps, you will successfully configure OpenID Connect between Salesforce and LearnWorlds.

If you're using OpenID as an authentication method, it's mandatory to change the Site Navigation settings in the Payment Flow section for Logged-out users, as they will need to sign up/log in before proceeding to the payment page.

Also, you need to ensure that in all Payment Sections of your school's pages, 1-click Sales funnels, or the Payment Page of your school, the Sign in/up form option is set to hide since the user will not be able to sign in/up via the Learnworlds system.

• If you set up an SSO solution and disable the LearnWorlds login, all the users will be redirected to the SSO provider to authenticate, LearnWorlds passwords will no longer be valid. The users need to exist or sign up with the SSO authentication provider. The change of the authentication provider will only change the authentication mechanism, all the user data as well as their roles (admin, instructor, etc.) will be intact. 
• The SSO mechanism uses the user’s email address to identify the user (unique key); therefore, to change the user's email address, you need to manually update the new email both in your school and on your IDP.

  Furthermore, you may use the bulk import (and enroll) functionality in case you need to import users that already exist in your SSO provider.
  

• Reverting to LearnWorlds authentication requires SSO users to create a new passwordvia the forgot password or admin reset functions.
  
• Password reset and sign-up are only available for LearnWorlds authentication. Any other SSO authentication mechanisms will need to handle these functionalities. 
• If SSO is misconfigured and is the only login option, only the School Owner can sign in via LearnWorlds login (https://account.learnworlds.com/login).
• The built-in Affiliate Management program can not be used for users who use SSO providers to sign in.
• For more than three custom SSO, SAML, or OpenID solutions, contact [email protected]. Learning Center plan users can add three more with the scale package.