Summary
The SSO SP tab configures single sign-on where KnowledgeCity acts as the Service Provider: your own identity provider authenticates users and logs them into KnowledgeCity. This article explains how to set up the SAML connection so people sign in to KnowledgeCity with their existing corporate credentials.
Introduction
Single sign-on lets your users reach KnowledgeCity without maintaining a separate password. On the SSO SP tab, an external identity provider (IdP) is the source of truth for who a user is, and KnowledgeCity trusts the signed assertion it receives to complete the sign-in. This is the mirror image of the SSO IDP tab: there KnowledgeCity is the identity source that logs users into an external application, whereas here an external system logs users into KnowledgeCity.
This feature is used by administrators and integration owners, the people responsible for provisioning access and connecting KnowledgeCity to their organization's identity provider. It solves the problem of giving learners secure, seamless access using the credentials they already have, while keeping identity centrally managed.
Key Concepts
- KnowledgeCity as Service Provider (SP): KnowledgeCity receives and trusts a signed assertion from your identity provider to sign a user in.
- Identity Provider (IdP): your external system that authenticates the user and issues the SAML assertion.
- SSO type: the protocol used for the connection, either SAML or OAuth.
- SAML subject name id: the user field that identifies the person signing in, such as Email or Username.
- Attribute mapping: the correspondence between fields sent by your identity provider (such as email, first name, last name, and group) and the matching fields in KnowledgeCity, which must be correct for users to resolve to the right account.
- Metadata exchange: the setup step where each side shares its configuration (entity identifiers, endpoints, and signing certificates) so SAML trust can be established.
Steps to Follow
Accessing the SSO SP tab
You reach the configuration from Accounts Manager. Open an account's Actions (⋮) menu and choose the SSO SP option, which opens the account's edit page on the SSO SP tab. Any existing configurations for the account are listed here.
Adding an SSO connection
Choose the SSO type, either SAML or OAuth, and add a new configuration to open the setup form. Give the connection a descriptive display name so you can identify it later.
Exchanging metadata with your identity provider
Setting up SSO requires exchanging metadata between KnowledgeCity and your identity provider. Export KnowledgeCity's service-provider metadata and provide it to your IdP, then bring your IdP's details back into KnowledgeCity. Depending on your provider, you can enter the connection details manually or use Import SP metadata (an xml or cer file) to populate the endpoint and certificate fields automatically.
The core SAML fields involved in the exchange are the Entity ID, the Assertion Consumer Service, the Single Logout Service, and the x509 Certificate. You can also set the Public Certificate Lifetime (days), which controls how long KnowledgeCity's certificate remains valid (the default validity period is 3650 days).
Choosing the subject and mapping attributes
Set the SAML subject name id to the attribute that identifies the user signing in, for example Email or Username. Then map the incoming attributes such as Email, First Name, Last Name, and Group to the corresponding fields in KnowledgeCity. Accurate mapping is essential: without it, users may not resolve to the right account or gain the access they need.
Advanced options are also available, including Attribute hooks and a List of services to check access (configured as a JSON array), plus Multi Auth to allow more than one authentication configuration.
Saving and testing the connection
Save your changes to create the connection. After saving, always run a connection test to confirm the end-to-end sign-in flow works before you communicate the change to users. Each connection also shows its last edit date and can be reopened for editing.
Conclusion
The SSO SP tab lets an external identity provider sign users in to KnowledgeCity over SAML, with KnowledgeCity acting as the service provider. Exchange metadata with your IdP, choose the subject identifier, map the incoming attributes, then save and test the connection before rollout to give your users reliable, secure single sign-on.