Single sign-on (SSO) is a highly secure, time-saving user authentication process. SSO lets users access multiple applications with a single account and sign out instantly with a single click.
TalentLMS supports SSO. To facilitate single sign-on on your domain, TalentLMS acts as a service provider (SP) through the SAML (Secure Assertion Markup Language) standard.

You can create an SSO integration between TalentLMS and Salesforce so that your Salesforce users can authenticate and log in to TalentLMS via SSO.

Enabling Salesforce as an Identity Provider

1. Log in to Salesforce as an Administrator.
2. From Setup, in the Quick Find box (1), type Identity Provider, then select Identity Provider (2).
   
3. Click Enable Identity Provider.
4. Select a certificate from the drop-down menu or create a new one.
5. Save your changes.

Creating a connected app for SAML 2.0

1. In Salesforce, from Setup, in the Quick Find box, look for and select App manager.
2. Select New connected app.
3. Fill in Connected App Name, API name, and Contact email with your information. You can name the app as you like (i.e., Training center). This is how the app will appear in the App launcher later.
4. Under Web App Settings, check the Enable SAML (1) checkbox.
5. Enter your TalentLMS SP metadata as per below, adding your TalentLMS portal name in place of {domain};
   Start URL - https://{domain}.talentlms.com/index/ssologin/service:saml
   Entity ID - {domain}.talentlms.com
   ACS URL - https://{domain}.talentlms.com/simplesaml/module.php/saml/sp/saml2-acs.php/{domain}.talentlms.com
6. If you wish to enable Single Logout, check the Enable Single Logout (2) checkbox, and enter your TalentLMS SLO URL, as such: https://{domain}.talentlms.com/simplesaml/module.php/saml/sp/saml2-logout.php/{domain}.talentlms.com.
   Select HTTP redirect as the Single Logout Binding.
7. Click Save at the bottom of the page.

Configuring the attribute mapping

In TalentLMS, the 4 mandatory fields for SSO are First name, Last name, Email, and Username.

Salesforce automatically creates attributes for Username and Email for the SSO-connected app, but you will need to add an attribute for First name and Last name.

1. From Setup, in the Quick Find box, search for Apps, then select App Manager.
2. Locate the TalentLMS SSO app you have created, and select View.
3. Scroll down to Custom Attributes and click New (1).
   
4. In the Attribute key (1) field, enter the name of the attribute, e.g. First name.
5. In the Attribute value field, click Insert field (2), and a dialog box will appear.
6. From this dialog box, you can select from which Salesforce field this attribute will pull data. For example, $User - First Name will pull the First Name field value into the attribute.
7. After selecting the attribute value, click Insert (3).
   
   
8. Then click Save.
9. Add another custom attribute for Lastname, following the same method outlined above.

Gathering Salesforce IdP info

1. From Setup, in the Quick Find box, search for App Manager and click to Manage the TalentLMS SSO connected app.
2. Note down the Issuer (1) in the SAML Service Provider Settings section.
3. Note down the SP-Initiated Redirect Endpoint (2) value.
4. Note down the Single Logout Endpoint (3) value if using.
5. Click on the Idp Certificate (4) link, and then select Download certificate.
   

Setting up SSO in TalentLMS

1. Log in to TalentLMS as an Administrator.
2. Go to Account & Settings > Users (if setting up SSO for a branch, go to Branches > [branchname]), and click to enable Single Sign On.
3. Enter your Salesforce metadata as per the below; 
   • SSO integration type - SAML 2.0
   • Identity provider (IdP) - Issuer from the Gathering Salesforce IdP info section
   • Certificate fingerprint - Open your downloaded certificate from the Gathering Salesforce IdP info section in your preferred text editor (Notepad for example), copy the contents of the file, then click “or paste your SAML certificate (PEM format)” in TalentLMS and paste the PEM certificate inside the textarea
   • Remote sign-in URL - SP-Initiated Redirect Endpoint from the Gathering Salesforce IdP info section
   • Remote sign-out URL - Single Logout Endpoint from the Gathering Salesforce IdP info section
4. For the Attribute mapping, you can select whichever attributes you like for the corresponding fields in TalentLMS. The 4 mandatory attributes are Firstname, Lastname, Email, and Username. As an example, we will use the following:
   TargettedID - username
   First name - Firstname
   Last name - Lastname
   Email - email
5. Click Save and check configuration. This will take you to Salesforce to authenticate and then back to TalentLMS to a page listing all the mapped attributes and values and all attributes and values sent from Salesforce in the SAML response. If everything looks correct, the integration is complete.