Incoming SAML 2.0 Single Sign-On using Azure AD

The main purpose of establishing a Single Sign-On (SSO) process with SkillSync is to allow your users a single point of entry into your system while providing them access to multiple other independent systems. With this process, a user logs in with a single ID to gain access to a multitude of other systems without being prompted for different usernames and passwords.

This article discusses Incoming SAML 2.0 SSO for clients using Azure AD and presents a somewhat abridged and focused version of our full Incoming SAML 2.0 Single Sign-On article. For the purposes of this article, the SkillSync system will act as the Service provider (SP). Your Azure system will act as the Identity Provider (IdP).

Usage Advisory

SSO is an additional feature that usually involves an additional fee and technical resources outside of SkillSync LMS to develop and/or configure the solution.

SkillSync LMS supports Incoming SAML 2.0 Single Sign-On as a feature, however we do not officially support any specific client-side (IdP) solution. Although Azure AD is known to generally work with our implementation of SAML SSO, it is the client's responsibility to configure/develop and maintain their side of the integration. This will require a client resource who is knowledgeable and familiar with your Azure AD environment. This guide is provided to our clients as a convenience only, based on our experience working with clients who employ Azure AD.

SkillSync Setup

This section will walk you through how you would configure your SkillSync LMS. Once the Azure AD is set up in your company account, a System Admin will need to log into the LMS and complete the setup.

From Portal Settings, there is a button in the right-side context menu labeled Manage SSO Settings. If you cannot see this button, please contact your SkillSync Client Success Manager to discuss enabling the feature.

Once you have clicked the button, you will be brought to the Manage Single Sign-On Settings page. Any existing configurations will appear here, as well as the option to Add a new one. 

Each route (Portal URL, e.g. company.myabsorb.com) can have its own set of SSO configurations. Please see this article for more information on route-based SSO. The remainder of this article assumes we're talking about a single SSO configuration.

Managing SSO Settings

The following variables will need to be determined and configured as part of your SSO implementation. 

Variables	Description	Requirement
Name	Enter a value to identify this SSO configuration. This field is for your reference only.	Mandatory
Method	Select SAML.	Mandatory
Key	The key is the x509 public certificate of the IdP that is used for the SAML assertion signature. You must configure SkillSync with your IdP’s public key so that SkillSync can verify your signed SAML assertions.	Mandatory
Mode	Choose the request mode to be used, from either Service Provider Initiated or Identity Provider Initiated. We recommend selecting Service Provider Initiated when possible. This has two key benefits: - LMS deep links will function as expected - SSO can be used to access the mobile app	Mandatory
ID Property (Unique Identifier)	A unique identifier field is chosen in the SkillSync LMS to be used as the identifying NameID through the SAML assertion. SkillSync can be configured to use the following as the Id Property: • Id (Randomly generated identifier in SkillSync database) • Username • Email Address • External Id • Employee Number	Mandatory
Signature Type	Select the correct option for your configuration.	Mandatory
Login URL	• Service Provider Initiated Mode: This is the endpoint where SkillSync will send a SAML request. • Identity Provider Initiated Mode: This is the URL where SkillSync redirects users if they navigate directly to the selected Route(s) without an active session. This redirect is only triggered when the Automatically Redirect feature is turned on.	• Mandatory for SP-initiated • Mandatory for IDP-initiated with Automatically Redirect ON • Optional for IDP-initiated with Automatically Redirect OFF
Logout URL	This is the URL where SkillSync redirects users when they log out of the SkillSync system.	Optional
Single Logout	Enables the single sign-out endpoint. This will attempt to sign the learner out of the identity provider when they log out of the LMS. If this is on, the Logout URL set above will be ignored.	Optional
External Single Logout URL	The external SLO endpoint to direct single log-out requests to.	Optional
Wait for Idp Response	Forces SkillSync to wait for a response from the identity provider before logging out of SkillSync.	Optional
Enforce Admin Side SSO	Enforces SSO Redirection on the Admin login page.	Optional
Automatically Redirect	This setting only displays when Identity Provider Initiated Mode is selected. When turned on, this will redirect all users who navigate directly to the selected Route(s) to the Login URL. If not turned on, users will land on the portal's landing page. Note: When Service Provider Initiated Mode is selected, this setting is hidden. All unauthenticated users who navigate to the selected Route or Routes will be authenticated through SSO.	Optional
Assigned Routes	Use this field to search for and select a Route or Routes to assign to this SSO configuration. A Route must be selected in order for SSO authentication to be successful. This Route will be referenced in the settings you configure in your Identity Provider.	Mandatory
Allow User Provisioning	This setting determines whether User Provisioning is enabled. To successfully create users via this method, the required values must be sent in the Attribute Statement. For further details, see our article on user provisioning: Incoming SAML 2.0 SSO Account Provisioning	Optional

Azure/Entra Setup

This section contains instructions specific to setting up Azure/Entra with SkillSync LMS. Each part focuses on a different element of this setup, concluding with finalizing settings on the SkillSync side. This setup must be completed by a System Admin on the SkillSync side and someone with full system access on the Azure/Entra side.

Default Attributes in Azure/Entra

The default Attribute Names for elements such as First Name, or Location in Azure/Entra do not match the expected Attribute Names on the SkillSync side for User Provisioning. An Attribute for the Department of the User must be created and named correctly in Azure/Entra. You must update the Attribute Names on the Azure/Entra side for User Provisioning to operate successfully.

For more information about Attribute Names, or User Provisioning review the following article:

• Incoming SAML 2.0 SSO Account Provisioning

Part 1: Add SkillSync LMS from the Gallery

To configure the integration of SkillSync LMS into Azure AD, you need to add SkillSync LMS from the gallery to your list of managed SaaS apps.

1. Sign in to the Azure portal using either a work or school account, or a personal Microsoft account.
2. On the left navigation pane, select the Azure Active Directory service.
3. Navigate to Enterprise Applications and then select All Applications.
4. To add a new application, select New application.
5. In the Add from the gallery section, type SkillSync LMS in the search box.
6. Select SkillSync LMS from the results panel and then add the app. Wait a few seconds while the app is added to your tenant.

Part 2: Configure and Test Azure AD SSO for SkillSync LMS

Configure and test Azure AD SSO with SkillSync LMS using a test user. For SSO to work, you need to establish a link relationship between an Azure AD user and the related user in SkillSync LMS.
To configure and test Azure AD SSO with SkillSync LMS, perform the following steps:

1. Configure Azure AD SSO - to enable your users to use this feature.
   • Create an Azure AD test user - to test Azure AD single sign-on with your Test User.
   • Assign the Azure AD test user - to enable Test User to use Azure AD single sign-on.
2. Configure SkillSync LMS SSO - to configure the single sign-on settings on the application side.
   
   • Create SkillSync LMS test user - to have a counterpart of Test User in SkillSync LMS that is linked to the Azure AD representation of the user.
3. Test SSO - to verify whether the configuration works.

Part 3: Configure Azure AD SSO

Follow these steps to enable Azure AD SSO in the Azure portal:

1. In the Azure portal, on the SkillSync LMS application integration page, find the Manage section and select Single Sign-On (SSO).
   
   
2. On the Select a single sign-on method page, select SAML.
   
   
3. On the Set up single sign-on with SAML page, click the pencil icon for Basic SAML Configuration to edit the settings.
   
   
   
   
4. On the Set up Single Sign-On with SAML page, click the Edit button to open the Basic SAML Configuration dialog.
   
   • In the Identifier text box, type a URL using the following pattern: https://<SUBDOMAIN>.myabsorb.com
   • In the Reply URL text box, type a URL using the following pattern: : https://<SUBDOMAIN>.myabsorb.com/api/rest/v2/authentication/saml
     Note: <SUBDOMAIN>.myabsorb.com needs to be replaced with the Route selected within your LMS SSO Settings.
   • The following screenshot shows the list of default attributes. You can choose which value to map as the Unique User Identifier. This should match the ID Property selected within SkillSync.
     
     
     
5. On the Set up Single Sign-On with SAML page, in the SAML Signing Certificate section, click Download to download the Certificate (Base 64) and save it on your computer so you can retrieve the Key value for the LMS SSO Settings.
   
   
   
   
6. On the Set up SkillSync LMS section, copy the Login URL. This will be the Login URL entered in the LMS SSO Settings if you are using Service Provider Initiated Mode.
   
   

Note: If you are using Identity-Provider Initiated Mode, you will instead need to navigate to the Properties page for the Application being used for SSO (e.g. 'SkillSync LMS'), and copy the User access URL for use as the Login URL.

Part 4: Assign an Azure AD Test User

In this section, you'll enable a test user to use Azure single sign-on by granting access to SkillSync LMS.

1. In the Azure portal, select Enterprise Applications, and then select All applications.
2. In the applications list, select SkillSync LMS.
3. In the app's overview page, find the Manage section and select Users and groups.
4. Select Add user, then select Users and groups in the Add Assignment dialog.
5. In the Users and groups dialog, select your test user from the Users list, then click the Select button at the bottom of the screen.
6. In the Add Assignment dialog, click the Assign button.

Part 5: Configure SkillSync LMS SSO

1. In a new web browser window, sign in to your SkillSync LMS as a user with the System Admin role.
2. Select the Account button at the top right.
3. In the Account pane, select Portal Settings.
4. Select the Manage SSO Settings button.
5. Select Add if you haven’t begun the set up yet.
6. On the Manage Single Sign-On Settings page, do the following:
   
   • In the Name textbox, enter a name such as Azure AD Marketplace SSO.
   • Select SAML as the Method.
   • In Notepad, open the certificate that you downloaded from the Azure portal. Remove the ---BEGIN CERTIFICATE--- and ---END CERTIFICATE--- tags. Then, in the Key box, paste the remaining content.
   • In the Mode box, select Service Provider Initiated or Identity Provider Initiated, per your requirement. Note: Service Provider Initiated is recommended.
   • In the Id Property box, select the attribute that you configured as the user identifier in Azure AD.
   • Select Sha256 as a Signature Type.
   • In the Login URL box, paste either the Login URL (if Service Provider Initiated is selected) or the User Access URL from the application's Properties page (if Identity Provider Initiated is selected).
   • In the Logout URL, enter the URL where you wish to direct users after they log out of the LMS.
   • Under Assigned Routes click the plus button to select an existing Portal Route.
7. Select Save.

Assigning a Route Activates SSO

Once all other configuration is complete SSO is 'accessed' by assigning a Route to the SSO configuration and saving. Depending on your use-case, you may also want to activate Automatically Redirect so that Users navigating to the Assigned Route are prompted to sign in via SSO if they aren't already authenticated.