How do I configure Single Sign-On with Active Directory (ADFS)?

LearnPlatform integrates with any Identity Provider implementing Single Sign-On (SSO) with SAML 2.0. This guide outlines how to set up SSO with Active Directory (AFDS).

Prerequisites for setup:

  • Administrator access to your organization’s LearnPlatform account
  • ADFS Administrator access through your organization to process SAML Single-Sign-On correctly
  • Your organization’s LearnPlatform subdomain: This must be listed in LearnPlatform's setting configurations.

Note: Once enabled, our system does not notify your staff that they have access to LearnPlatform.

Open Single Sign-On Page

Open Single Sign-On Page

Sign in to your LearnPlatform administrator account. In the Settings tab [1], click the Single Sign-On tile [2].

Enable Single Sign-On

Enable Single Sign-On

Click the Single Single-On Type drop down menu [1], and select the SAML 2.0 option [2].

Copy Callback URLs

Enable Callback URLs

Click the Use organization domain for callback urls toggle on [2], and then copy the following URLs:

  • AssertionConsumerService (ACS) URL/callback url [2]: Your ACS URL in your Service Provider Details for the LearnPlatform app is https://[YourSubDomain].app.learnplatform.com/users/auth/saml/callback/
  • Entity ID/Metadata URL [3]: Your Entity ID/Metadata url in your Service Provider Details for the LearnPlatform app is https://[YourSubDomain].app.learnplatform.com/users/auth/saml/metadata/

Configure ADFS

  1. On a separate window or tab, sign in to your ADFS Management dashboard.
  2. Go to Trust Relationships and select the Relying Party Trusts option.
    1. Select the Import data about the relying party published online or on a local network radio button.
    2. Click the Add Relying Party Trusts link and add your LearnPlatform’s metadata address: https://[YourLearnPlatformSubDomain].app.learnplatform.com/users/auth/saml/metadata/
    3. Click the Next button, and then add a Display Name or keep the default name.
    4. Click the Next button, and then click the Permit all users to access this relying party radio button.
    5. Click the Finish button. You should see LearnPlatform (or your chosen display name) under your Relying Party Trusts list in the ADFS management tool.
  3. Right-click on the displayed name and click the Add Rule option.
    1. Select the Send LDAP Attributes as Claims option.
    2. Click the Next button and add a Claim Rule Name or keep the default name.
    3. Click the Attribute store drop-down menu and select the Active Directory option.
    4. In the Mapping of LDAP attributes to outgoing claim types section, complete the following:
      • For the LDAP attribute, select the SAM-Account-Name option.
      • For the Outgoing Claim Type, select the Name ID option
    5. A new row displays which allows you to map attributes you want to send through the connection. Personalize the LDAP Attribute and Outgoing Claim Type based on your specific Active Directory settings for your district.
      • The left input must contain the attribute you want to send.
      • The right input must contain the field that LearnPlatform will match to that data.
      • Here is an example of completed attribute mapping:
        • LDAP Attribute: Surname; Outgoing Claim Type: LastName
        • LDAP Attribute: Given-name; Outgoing Claim Type: FirstName
        • LDAP Attribute: E-Mail Addresses; Outgoing Claim Type: email
    6. To complete the ADFS setup, click the Finish button.
  4. While still in the ADFS Management console, locate your metadata URL.
    • Go to Service > Endpoints > Metadata > Type: Federation Metadata.
    • The URL is typically displayed as https://<ADFS server name>/federationmetadata/2007-06/FederationMetadata.xml
  5. Copy the metadata URL to your clipboard.

Configure LearnPlatform Account

Configure LearnPlatform Account

Go back to the LearnPlatform Single Sign-On set-up page. In the Identity Provider Redirect URL field, paste the metadata URL you just copied.

Add Mapping Attributes

Add Mapping Attributes

Enter the same attribute mapping fields you added in your ADFS Management Console.

Add Certificate

Add Certificate

In the ADFS Management Console, download or copy the app’s certificate.

Go back to the LearnPlatform Single Sign-On set-up page, and in the Certificate field, enter the entire certificate text using this format:

-----BEGIN CERTIFICATE-----

[Full certificate value from ADFS Management Console]

-----END CERTIFICATE-----

Note: Make sure not to include any spaces or change the formatting of the certificate. You must download the certificate into a text editor like NotePad or TextHelp. If you use another program, it may pull characters such as HTML into the certificate and will not paste correctly.

Finish Configuring AFDS

Finish Configuring AFDS

In the LearnPlatform Single Sign-On set-up page, locate and copy the callback url.

Go back to the ADFS Management console and click the LearnPlatform Relying Partner link. In the Endpoints tab, click the Add SAML button and enter the following values:

  • Endpoint type: SAML Assertion Consumer
  • Binding: POST
  • Index: 1
  • Trusted URL: https://[YourSubDomain].app.learnplatform.com/users/auth/saml/callback/
  • To save the new end point, click the OK button.
Add Metadata URL to AFDS

Go back to LearnPlatform’s SAML setup page and copy the metadata url.

In your ADFS Management Console, paste the metadata URL in the Relying Party Trust Identifiers field. Make sure you capture the backward slash (/) at the end and avoid any spaces. If the URLs are not complete, your setup may not work properly.

Set to ON for everyone first, test the SSO, then go back and restrict access if necessary. 

Your link to login to LearnPlatform is https://[YourSubDomain].app.learnplatform.com/users/sign_in/

Notes:

  • These settings may take up to 24 hours to take effect for all users.
  • You can find your subdomain in the Display Appearance settings.