Single Sign-On (SSO)

Owned by joe.pernick (Deactivated)
Last updated: Jul 29, 2024 by Aamir Sheriff
2 min read

CampusGroups supports two Single Sign On methods

  • CAS

  • SAML

​All SSO methods will match the provided user identifier against the email and netid values in user profiles.

In addition, the SAML integration can automatically provision new users as they first sign in if necessary using Just In Time Provisioning.

CAS integration

You will need to provide us with the CAS base url to use (https://domain.edu/idp/profile/cas/ for instance).

SAML integration

We support most standard identity providers, including Shibboleth, ADFS, Azure AD, Okta, etc.

CampusGroups SAML Information

 

Basic SSO Configuration Requirements

  1. Add our Service Provider as a trusted party

    1. For InCommon Federation Members, use our EntityID

    2. For Non InCommon Federation Members, use our Metadata URL

     

  2. Provide your Metadata information

    1. For InCommon Federation Members provide the entityId of your Identity Provider

    2. For Non InCommon Federation Members

      1. Provide a link to your Metadata or a copy of the Metadata File itself

      2. Provide the entityId of your Identity Provider
        ​

  3. Confirm user identifier attribute release.

    Attributes must be released in urn:oid format and may require additional configuration in your Identity Provider system.
    ​You will need to release at least one attribute with a name from the following list and whose value will be used as the primary identifier for users signing in:

    Attributes are case sensitive and should be lower case.

    1. urn:oid:1.3.6.1.4.1.5923.1.1.1.6 (also referred to as "eppn"; only applicable for customers running Shibboleth IdP as their Identity Provider using a configuration that matches the EduPerson standard)

    2. urn:oid:0.9.2342.19200300.100.1.3 (also referred to as "mail"; best choice if the primary identifier you will be releasing also serves as a valid email address for the user)

    3. urn:oid:0.9.2342.19200300.100.1.1 (also referred to as "uid"; best choice if the primary identifier you will be releasing is not a valid email address for the user)

     

  4. Please send this information to our Integrations team at integrations@readyeducation.com. We will configure your SSO connection and follow up with testing and verification next steps.

 

After completing your Basic SSO setup, we recommend that you determine your desired method for automated user provisioning, and work with our Integrations Team to set this up. More information about available options can be found in our Automated User Provisioning section. If you have any questions, contact the Integrations team at integrations@readyeducation.com.

Â