Professional Learning Single Sign-On

Single sign-on authentication for administrative users and teachers is supported for Professional Learning using an external identity provider, such as Google or Microsoft. 

Prerequisites

• The identity provider must be supported. The certified identity providers are Microsoft and Google. 
• Support for the SAML standard.
• User accounts must be provisioned for the identity provider.
• Shibboleth version 2 or 3.
• The following unique identifiers are supported:  employee ID, username, or email address. If your district needs to use a different value for the global ID, you can choose to add an SSO ID field to Professional Learning. For Google, use email address. 

Set up Single Sign-On

This procedure is an overview of the steps involved in setting up single sign-on.  

1. Contact PowerSchool to start setting up SSO. 
2. If you intend to use a value other than employee ID, user name, or email address as the unique ID for users, let PowerSchool know.  PowerSchool will add an SSO ID field to Professional Learning and update the User Import file to include the new field.
3. If your district is using the SSO ID field, update the user import file with the unique values for users. Move the spreadsheet to the standard location for integrating files with Professional Learning so the file can be synchronized.
4. PowerSchool will provide the ACS URL, Entity ID, Metadata URL, and Start URL required to set up the application in the identity provider.
5. In the identity provider, create an application using SAML SSO for Professional Learning.
6. Download the metadata file or copy the metadata URL from the identity provider.   
7. Provide the metadata file or URL to PowerSchool so they can configure and enable SSO. Also, indicate the Name ID field you are going to use as the global ID.
8. PowerSchool will set up and enable the SAML authentication.Shibboleth and IIS must be restarted as part of enabling SSO.