Connect your identity provider
OpenID Connect, SAML 2.0 and LTI 1.3: what each side needs from the other.
Everything is configured under Administration > Authentication, and you need the owner or admin role. Replace {slug} with your organisation's short identifier, shown under Administration > Settings.
OpenID Connect
The most common setup. Create an application in your provider, allow the redirect URI below, then copy its values to us.
Give your provider
- Redirect URI :
/api/auth/oidc/callback - Login entry point :
/auth/oidc/{slug}/login
Give us
| Field | What it is |
|---|---|
issuer | The issuer your provider advertises. It is also what we verify inside the token.https://login.microsoftonline.com/<tenant>/v2.0 |
client_id | The application id you just created. |
client_secret | Its secret. It is never shown again after saving. |
authorize_url | The authorization endpoint the user is sent to..../oauth2/v2.0/authorize |
token_url | The endpoint that exchanges the code for a token..../oauth2/v2.0/token |
jwks_url | The public keys used to verify the token signature..../discovery/v2.0/keys |
default_role(optional) | The role given to someone signing in for the first time. Trainer by default.trainer | admin |
Claims we use
We read only these three claims from the id token: email, name, locale
Email is required: it is what links the person to an account. Name and locale are used when present. Someone who already exists keeps the language they chose - an SSO sign-in does not overwrite it.
SAML 2.0
Our service provider metadata is generated: give your identity provider its URL rather than copying fields by hand.
Give your provider
- Service provider metadata :
/auth/saml/{slug}/metadata - Assertion consumer service (ACS) URL :
/auth/saml/{slug}/acs - Login entry point :
/auth/saml/{slug}/login
Give us
| Field | What it is |
|---|---|
idp_metadata_xml | Your provider's metadata XML, pasted as-is. It carries the issuer, the login URL and the signing certificate. |
default_role(optional) | The role given to someone signing in for the first time. Trainer by default.trainer | admin |
LTI 1.3
For launching a lab from an LMS (Moodle, Canvas). Registration happens on both sides: your LMS declares our tool, and we declare your platform.
Give your provider
- Launch URL :
/api/lti/{registrationId}/launch
Give us
| Field | What it is |
|---|---|
platform_issuer | Your LMS issuer.https://moodle.example.org |
client_id | The client id your LMS assigns to our tool. |
auth_login_url | Your LMS login initiation endpoint..../mod/lti/auth.php |
jwks_url | Your LMS public keys..../mod/lti/certs.php |
deployment_ids | The deployment id or ids. An LMS issues one per installation placement. |
The role comes from the launch: an instructor arrives as a trainer, a learner arrives as a learner, straight into the lab.
Provider notes
The exact path to each setting, written out rather than screenshotted: these consoles change several times a year, and a stale screenshot sends you hunting for a button that no longer exists.
Microsoft Entra ID
App registrations > New registration. The redirect URI is of type Web. The authorize, token and keys URLs are under Endpoints, in their v2.0 form. Add the email permission if your tenant does not grant it by default.
Okta
Applications > Create App Integration > OIDC, Web Application. The issuer and endpoints come from the authorization server you use, often default. Check that the email scope is granted.
Google Workspace
Google Cloud console > Credentials > OAuth client ID, Web application type. The issuer is accounts.google.com. Locale is not sent, so accounts keep the interface language.
Any other OIDC provider
Any compliant provider works. If yours publishes a discovery document, the four URLs we ask for are in it under authorization_endpoint, token_endpoint, jwks_uri and issuer.
When it does not work
- The provider rejects the redirect
- The URI must match character for character, including scheme and trailing slash. This is the most common cause and the quietest one.
- Sign-in succeeds but no account appears
- The token carries no email claim. Add the matching scope at your provider: without an address we have nothing to attach the person to.
- Everyone arrives with the wrong role
- The default role applies only on first sign-in. Someone already a member keeps the role they had; change it under Administration > Members.
- The login URL returns an error
- Check the {slug}: it is the organisation's short identifier, not its display name.
Still stuck? Write to us