SmartFind Express Single Sign-on with PowerSchool SIS as IdP

SmartFind Express supports single sign-on (SSO) authentication for administrative users and teachers using PowerSchool SIS.

Prerequisites

• PowerSchool SIS v20.4.0.0 or higher.
  
• PowerSchool SIS and SmartFind Express are integrated

• The Global User ID field in SmartFind Express must store the linked account information in the format of $SISURL/uri/admin/$Account DCID where $SISURL represents the school district's URL for PowerSchool SIS, admin represents the persona, and Account DCID represents the user's unique ID in the PowerSchool SIS. For example https://powerschool.district.com/uri/admin/12345.

Set up Single Sign-On

This procedure is an overview of the steps involved in setting up single sign-on.  

1. Contact PowerSchool to start setting up SSO. 
2. PowerSchool provides the plugin to set up SSO for SmartFind Express. 
3. Install and enable the plugin in PowerSchool SIS. To install the plugin, navigate to System > System Settings > Plugin Management Configuration.
4. Retrieve the OAuth credentials from the SmartFind Express plugin from PowerSchool SIS. The required credentials are:
   • Client ID
   • Client Secret
   • SIS URL
5. Send the information for the application to the PowerSchool Implementation or Support team member so they can configure and enable SSO. Do not include the client ID and client secret in the same email.
6. PowerSchool provides the Redirect URI for SmartFind Express.
7. Enter the Redirect URI in the SmartFind Express plugin in PowerSchool SIS in the Resource Server Base URL field. 
8. Contact PowerSchool to indicate that SSO can be enabled. The application server will need to be restarted after SSO is enabled.

Manage OAuth Credentials for SmartFind Express from PowerSchool SIS

1. In PowerSchool SIS, select System > System Settings > Plugin Management Configuration.
2. Locate the SmartFind Express plugin.
3. Ensure the plugin is enabled.
4. Click on SmartFind Express.
5. To retrieve the OAuth credentials for SmartFind Express, click on Data Provider Configuration.
   1. Highlight and copy the Client ID.
   2. Highlight and copy the Client Secret.
   3. Copy the SIS URL from the address bar. For example, highlight and copy the SIS URL (e.g., https://powerschool.district.com). 
6. To enter the Redirect URI for SmartFind Express, click on Data Provider Configuration. In the Three-Legged OAuth Configuration section, enter the URI in the Resource Server Base URL field.

Frequently Asked Questions

When a user logs out, are they logged out of the identity provider?

Single sign-out is not supported at this time. Users are not signed out of the identity provider or other PowerSchool products when they sign out. Refer users to the appropriate location to sign out of the identity provider.