PowerSchool ERP Single Sign-On with PowerSchool SIS as IdP

PowerSchool ERP supports single sign-on (SSO) authentication for administrative users and teachers using PowerSchool SIS.

Prerequisites

• PowerSchool ERP version 19.4.16.0 and later.
• PowerSchool SIS v20.4.0.0 or higher.
  
• PowerSchool SIS and PowerSchool ERP are integrated.
• All users who need to sign in to PowerSchool ERP and Employee Access Center must also be defined in PowerSchool SIS. 

• The SSO Identifier field in PowerSchool ERP must store the linked account information in the format of $SISURL/uri/admin/$Account DCID where $SISURL represents the school district's URL for PowerSchool SIS, admin represents the persona, and Account DCID represents the user's unique ID in the PowerSchool SIS. For example https://powerschool.district.com/uri/admin/12345.

Set up Single Sign-On

This procedure is an overview of the steps involved in setting up single sign-on.  

1. Contact PowerSchool to start setting up SSO. 
2. PowerSchool provides the plugin to set up SSO for PowerSchool ERP. 
3. Install and enable the plugin in PowerSchool SIS. To install the plugin, navigate to System > System Settings > Plugin Management Configuration.
4. Map your user accounts to the global ID you are using from the identity provider using the SSO Identifier field. First export a spreadsheet of user accounts by running the Export Users for SSO. Update the spreadsheet to enter the user's unique identifier. Then, use the Import Global Users utility to map the data file and upload values to the GLOBAL_USER_SSO_MAPPING table to assign the SSO Identifier values for users.
5. Retrieve the OAuth credentials from the PowerSchool ERP plugin from PowerSchool SIS. The required credentials are:
   • Client ID
   • Client Secret
   • SIS URL
6. Configure and enable SSO for PowerSchool ERP. The application server will need to be restarted after SSO is enabled.
   • For districts that run eSchoolPlus on Cloud, contact PowerSchool to enable SSO. Provide the required credential information you recorded. Do not include the client ID and secret in one email.
   • For districts that run PowerSchool ERP on premise, use Environment Maintenance to define the AppSwitcher SSO Settings. Refer to the Single Sign-On help topic in the PowerSchool ERP System Administration help.

Manage OAuth Credentials for PowerSchool ERP from PowerSchool SIS

1. In PowerSchool SIS, select System > System Settings > Plugin Management Configuration.
2. Locate the Subscription Manager plugin.
3. Ensure the plugin is enabled.
4. Click on Subscription Manager.
5. To retrieve the OAuth credentials, click on Data Provider Configuration.
   1. Highlight and copy the Client ID.
   2. Highlight and copy the Client Secret.
   3. Copy the SIS URL from the address bar. For example, highlight and copy the SIS URL (e.g., https://powerschool.district.com). 

Frequently Asked Questions

When a user logs out, are they logged out of the identity provider?

Single sign-out is not supported at this time. Users are not signed out of the identity provider or other PowerSchool products when they sign out. Refer users to the appropriate location to sign out of the identity provider.