Summary
The SSO IDP (SSO Identity Providers) tab is where you configure single sign-on with KnowledgeCity acting as the SAML identity source for federated login. You define the external Service Provider's details, choose which user attribute identifies the subject, and map the attributes that KnowledgeCity sends. Once configured, your users can authenticate with KnowledgeCity credentials and be logged into an external application.
Introduction
The SSO IDP tab is the mirror image of the SSO SP configuration. Where an SP setup lets an external system log users into KnowledgeCity, the SSO IDP setup makes KnowledgeCity the identity source that logs users into an external Service Provider, the customer's own application. In this role KnowledgeCity authenticates the user and issues the SAML assertion that the external application trusts.
This feature is used by administrators who need their KnowledgeCity accounts to become the source of truth for authentication into another platform. It solves the problem of maintaining separate credentials across systems: with KnowledgeCity as the identity provider, your students use their KnowledgeCity login to gain access to a connected external application.
Key Concepts
- KnowledgeCity as IdP: in this configuration, KnowledgeCity authenticates the user and issues the assertion to the external application, becoming the source of truth for identity.
- SSO type: each configuration is either SAML or OAuth. For a SAML identity provider setup, you select SAML.
- Service Provider (SP): the external application that receives the assertion. You enter its details (or import its metadata) so KnowledgeCity knows where and how to send the assertion.
- SAML subject name id: the user field that identifies the subject in the assertion. Options include Username, Email, Id, or Employee Id.
- Attributes Map: the set of user attributes KnowledgeCity sends to the SP, such as Email, First Name, Last Name, Employee Id, Group, and Id.
- Metadata exchange: setting up SAML SSO involves exchanging metadata between KnowledgeCity and the external application; you can import the SP's metadata to fill its details automatically.
Steps to Follow
Accessing SSO IDP
In Accounts Manager, open an account's Actions menu (⋮) and choose SSO IDP. This opens the account's edit page on the SSO IDP tab. Existing configurations are listed here; if there are none yet, the tab indicates that no SSO data exists for the account.
Adding an IdP configuration
Choose the SSO type, selecting SAML for a SAML identity provider, and click Add. The configuration form appears. If you need to dismiss the form without saving, use the × to close it.
General settings
Complete the general settings for the configuration:
- Display label*: a name for this configuration.
- SAML subject name id: the field that identifies the user in the assertion: Username, Email, Id, or Employee Id.
- Attribute hooks: advanced access controls entered as configuration.
- List of services to check access (JSON Array): advanced access control rules, entered as a JSON array.
- Multi Auth: allows multiple authentication configurations.
Mapping attributes
Under Attributes Map, define the attributes that KnowledgeCity will send to the Service Provider. The available attributes include Email, First Name, Last Name, Employee Id, Group, and Id. Map these to what the external application expects so that user identity is communicated correctly.
Service Provider (SP) details
Enter the external application's Service Provider details: Entity ID, Assertion Consumer Service, Single Logout Service, and x509 Certificate. Rather than entering these by hand, you can use Import SP metadata (xml/cer) to populate these fields automatically from the SP's metadata file.
Identity Provider (IdP) settings and saving
Set the Public Certificate Lifetime (days) for KnowledgeCity's signing certificate, then click Save to store the configuration.
As the identity provider, KnowledgeCity vouches for user identities to the external system. Verify the SP details and test the login flow before the customer relies on it in production.
Conclusion
The SSO IDP tab lets KnowledgeCity serve as the SAML identity source for an account: you choose the SSO type, pick the subject identifier, map the outgoing attributes, and enter the external Service Provider's details or import its metadata. Save the configuration and test the flow before go-live so that federated login works reliably for your users.