Skip to content

Configuring Single Sign-On (SSO)

This feature is available to users with the Site Manager or Full administrator role. See Roles

IngenuitiLMS supports Single Sign-On (SSO) via modern identity providers, enabling learners and staff to authenticate using their existing corporate credentials without maintaining separate LMS passwords.

Supported Identity Providers

You can configure one or more of the following OAuth/OIDC identity providers:

  • Okta
  • Google Workspace
  • Microsoft Azure / Entra ID

Setting Up an SSO Provider

Follow these steps to configure an SSO integration:

  • Step 1 - Add a New Provider

    From the Management menu, select Site Settings > Single Sign-On (SSO). Click + Add SSO Provider.

  • Step 2 - Enter Provider Details

    Fill in the provider configuration form:

    • Provider Type: Choose Okta, Google, or Azure.
    • Display Name: Enter a user-friendly name (e.g., "Corporate Okta" or "Staff Microsoft Login") that will appear on login buttons.
    • Base URL (Okta only): Enter your organization's Okta domain (e.g., https://yourcompany.okta.com).
    • Tenant ID (Azure only): Enter your Microsoft Entra Directory (tenant) ID.
    • Client ID & Client Secret: Paste the client credentials generated from your identity provider's app registration portal. Secrets are stored encrypted.

  • Step 3 - Register Callback URL with Identity Provider

    After saving the provider, copy the generated Redirect / Callback URL from the LMS provider details page and paste it into the "Allowed Redirect URIs" section in your identity provider portal (e.g., Azure App Registration or Google Cloud Console).

  • Step 4 - Activate and Enable on Login Page

    • Active: Toggle to Active to enable the provider for authentication.
    • Show on Login Page: Toggle on to display a clickable "Sign in with [Provider Name]" button on your LMS sign-in page.

How Learner Auto-Provisioning Works

When a learner signs in via SSO for the first time:

  1. Existing User Match: If an LMS account already exists with the email address returned by the identity provider, the SSO identity is linked to that existing account.
  2. Auto-Provisioning: If no account exists with that email, the LMS automatically creates a new learner account with the name and email provided by the identity provider, and immediately logs the learner in.

Managing Linked Accounts

  • Learners: Can view their connected identity providers and manage links from their personal account settings.
  • Administrators: Can view connected SSO accounts on any user's profile in Manage Users and unlink an external identity if necessary.

Encrypted Secrets

Client secrets are encrypted at rest. For security reasons, the secret value is masked after initial entry and never displayed in plain text or audit logs.