SmartFind Express Single Sign-On

Single sign-on authentication for users is supported for Unified Talent SmartFind Express using an external identity provider, such as Google or Microsoft.

Prerequisites

• The identity provider must be supported. The certified identity providers are Microsoft and Google. 
• Support for the OIDC standard. Mobile Apps require Authorization Code PKCE Flow support.
• User accounts must be provisioned for the identity provider.
• AD FS 4.0 or greater.
• The Global User ID field in SmartFind Express must match the selected Claim from the identity provider. The selected identity provider determines the claim that is used. If you use Google, the claim is email. If you use Microsoft, the claim is oid.

Set up Single Sign-On

This procedure is an overview of the steps involved in setting up single sign-on. 

1. Contact PowerSchool to start setting up SSO. 
2. In the identity provider, add the application registration and configure the OIDC application.
3. Record the following information as you register the application:
   • Client ID
   • Client Secret
4. Send the information for the application to the PowerSchool Implementation or Support team member so they can configure and enable SSO. Do not include the client ID and client secret in the same email.
5. After PowerSchool configures SSO for SmartFind Express, we will provide the application's Redirect URI for the identity provider.
6. Update the SmartFind Express application in the identity provider to specify the Redirect URI.
7. Map your user accounts to the global ID you are using from the identity provider.
8. Contact PowerSchool to indicate that SSO can be enabled. The application server will need to be restarted after SSO is enabled.

Register the Application with the Identity Provider

Add SmartFind Express to Google

There may be additional settings that you can configure for the applications or Google may have updated the interface. Refer to Google documentation on Setting up OAuth 2.0. 

1. Open https://console.developers.google.com as an administrator.
2. If needed, create a new project and define the OAuth consent information.

3. In Credentials, create credentials for an OAuth Client ID.

   • Set up a web application with the PowerSchool application name.
   • If you have the application's Redirect URI, add it in the Authorized redirect URIs section. Otherwise, edit the application later to add the Redirect URI. 
4. Copy and save the Client ID and Client Secret values that display after the app is created. These values need to be added in the PowerSchool application.

To add the redirect URI after the app is created, select Credentials and edit the app.

Add SmartFind Express to Microsoft

The instructions provided are intended to guide administrators to set up PowerSchool applications that use OIDC. There may be additional settings that you can configure for the applications or Microsoft may have updated the interface. Refer to Microsoft documentation on registering an application with the Microsoft identity platform. 

1. Go to https://portal.azure.com as an admin of the IdP service. Then, search for and select Azure Active Directory.
2. In App registrations, add a new registration to set up the application. Enter an application name and select the supported account types.
3. In Authentication, add a platform configuration. Select Web and then enter the Redirect URI for the application.
4. In Certificates & secrets, add a new client secret and copy both the secret's Value and Secret ID. These values need to be added in the PowerSchool application.

5. Add a claim to your token (optional):

   1. Select Token Configuration > Add Optional Claim.

   2. Select the appropriate ID or Access as the Token Type.

   3. Select the claims you want to add. 

   4. Click Add.

Map Users for SSO

Bulk Provisioning

An operator can import a batch of users with their SSO credentials (global identifiers).

1. Create a bulk import file based on the format specified.
2. Choose System Operations > Import/Export > On-Demand Import.
3. Browse and select your bulk import file. The Delimited option must be selected with Delimiter set as | (single pipe).
4. Click Run Now.

Bulk Import File Format

For system-generated ID of the identity provider, choose Startup > Authentication > SSO: Manage Identity Providers > Identity Providers List. The ID column displays the system-generated ID for the identity provider.

Import Format

Add: W|A|2|Identity Provider Id|Access Id|Global user Id|

Change: W|C|2|Identity Provider Id|Access Id|Global user Id|

For Add(A) : Identity Provider Id, Access Id, Global user Id, all 3 are mandatory

For Change(C) : Identity Provider Id, Access Id, Global user Id, all 3 are mandatory

The Lenient Import processing parameter is set to ON or OFF. This system-level parameter allows districts control over how strictly import records are processed. The setting is contained with other background parameters established during system setup.

If set to OFF: when a record is imported to Add data, but the system finds the key fields for the record already in the system, it fails the record (and provides an error message); when a record is imported to Change data, but the system does not find the key fields to make the change, the system fails the record (and provides an error message).

If set to ON: when a record is imported to Add data, but the system finds the key fields for the record already in the system, it will process as a Change record; when a record is imported to Change data, but the system does not find the key fields for the record, the system will process as an Add record.

Remove Previously-Imported Global Identifiers

For Delete(D): Only identity provider ID is mandatory. Different combinations achieve different tasks.

• If only Identity Provider ID is provided, all mappings/relations for the given Idp will be deleted : W|D|2|Identity Provider Id| | |

• If Identity Provider ID is provided with Access ID, any row matching both will be deleted : W|D|2|Identity Provider Id| Access ID| |

• If Identity Provider ID is provided with Global user ID, any row matching both will be deleted : W|D|2|Identity Provider Id| |Global User ID|

• If Identity Provider ID is given along with Global user ID & Access ID, a row will be deleted only if it matches all the three fields : W|D|2|Identity Provider Id|Access Id|Global user Id|

Individual User Mapping

A SmartFind Express user can link their own credentials to SSO.

1. The SmartFind Express user logs in to the web application using the traditional login method.

2. They choose Profile > Identity Provider Mapping.

3. The user will see the logo of the identity provider and see an option to link their credentials for using SSO.

4. The user will be asked to authenticate with the identity provider. Upon successful login, the user's credentials will be linked and mapped to use the district's SSO feature for that identity provider.

Frequently Asked Questions

When a user signs out, are they signed out of the identity provider?

Yes, when the user signs out of SmartFind Express, they will be redirected to the sign out URL for the identity provider.