Single sign-on (SSO) is a time-saving and highly secure user authentication process. SSO lets users access multiple applications with a single account and sign out instantly with one click.

TalentLMS supports SSO. To provide single sign-on services for your domain, TalentLMS acts as a service provider (SP) through the SAML (Secure Assertion Markup Language) standard.

To get started, you need an Okta account to handle the sign-in process and provide your users’ credentials to TalentLMS.

The information required by TalentLMS is:

• A unique identifier for each user.
• The user’s first name and last name.
• The user’s email.

When users authenticate themselves through your IdP, their account details are handled by the IdP. Any changes made to those details (i.e., first name, last name, email) are synced back to TalentLMS. TalentLMS does not store any passwords.

A. How to integrate Okta and TalentLMS with the TalentLMS app

Okta provides registered users with a complete step-by-step guide to configuring the TalentLMS app. Here’s how to find it:

1. Sign in to your Okta account and go to Applications > Add Application.

2. In the search field, type talentlms, and on the search results that pop up, click Add next to the TalentLMS entry.

3. In the Subdomain field, type your TalentLMS domain name (i.e., if your TalentLMS domain is mycompany.talentlms.com, type mycompany), and click Done.

4. Go to the Sign On tab and click View Setup Instructions.

 You’re directed to an Okta-TalentLMS configuration manual that’s tailored to your account (i.e., it contains the exact parameters for integrating your Okta and TalentLMS accounts).

5. Follow the instructions closely to complete your integration.

B. How to configure SSO with a custom App in Okta

Phase 1: OKTA configuration

1. Sign in to your TalentLMS account as an administrator, go to Account and Settings > Users and click Single Sign-On (SSO).

2. From the SSO integration type dropdown list, choose the SAML 2.0 option.

3. Note down the Entity ID (1) and Assertion Consumer Service (ACS) URL (2), which you will later need to use when configuring the custom App in Okta.

4. Now, sign in to your Okta Admin dashboard, go to the Applications page, and click Create a new app integration

5. In the Sign-in method, choose SAML 2.0 (3), and click Next.

6. On the General Settings tab, set your App name (4), and click Next.

7. In the Single Sign-On URL (5), enter the Assertion Consumer Service (ACS) URL found in TalentLMS’s SSO configuration form (as shown above at step 3).

8. Ensure the Use this for Recipient URL and Destination URL (6) option remains checked.

9. In the Audience URI (SP Entity ID) (7), type the Entity ID found in the TalentLMS SSO configuration form (as shown above at step 3), and click Next.

10. Ensure that the “This is an internal app that we have created” (8) option is checked, and click Finish.

11. If not automatically redirected, return to the Okta applications page and choose the app you have created.

12. Select the Sign On tab.

13. In the Attribute Statements section, you will need to map the following four mandatory attributes:

- username
- firstname 
- lastname
- email

14. Click Add expression (9) to map those four attributes, as per the example below:

15. Under the Settings > SAML 2.0 section, click More details (10) to reveal the SSO app’s metadata.

16. Then click Certificate fingerprint (11) to reveal the available certificates.

17. Optional step: Skip this step if you already have an active SSO certificate. Otherwise, navigate to the Sign On tab on the SSO app in OKTA and click Generate new certificate (12). 

Phase 2. TalentLMS configuration

From Okta’s SAML 2.0 details and Certificate fingerprint revealed at step 16 from Phase 1, as seen above: 

1. Copy the Issuer value and paste it into the Identity Provider (IdP) (13) field in the TalentLMS SSO form.

2. Copy the SHA1 value and paste it in the Certificate fingerprint (14) field in the TalentLMS SSO form.

3. Copy the Sign-on URL value and paste it in the Remote sign-in URL (15) field in the TalentLMS SSO form.

4. Copy the Sign-out URL value and paste it in the Remote sign-out URL (16) field in the TalentLMS SSO form.

5. Fill in the Username, First name, Last name, and Email fields in your TalentLMS SSO form with the respective values you previously configured for mapping your Okta user attributes (as shown above, at Phase 1, step 14). Add any custom fields, if required.

- Based on the example’s values, the setup should look like this:

6. Finally, click on Save (17) after completing the SSO setup and assigning users/groups to your Okta app; users will be able to log in to TalentLMS via SSO.

Alternatively, click on Save and check configuration (18). This will take you to Okta to authenticate and then back to TalentLMS to a page listing all the mapped attributes and values sent from Okta in the SAML response. If everything looks correct, the integration is complete.

User Account Matching

At the time of writing, TalentLMS provides a passive mechanism for user account matching. That means that existing TalentLMS user accounts are matched against SSO user accounts based on their username.

User account matching can be achieved only when the username provided by your IdP is exactly the same as the username of the existing TalentLMS account. In that case, the state of the user’s TalentLMS account remains unaltered during the single sign-on process. However, the values for the user’s first name, last name, and email are pulled from your IdP and replace the existing ones.

When the username provided by your IdP for an existing TalentLMS user is different from their TalentLMS username, a new account is created for the IdP-provided username. In that case, two different accounts are attributed to the same person.

To make sure that user account matching works properly, configure your IdP to send the same usernames for all existing TalentLMS user accounts. The name of the SAML variable that carries the username is the one you type in the TargetedID field on the TalentLMS Single Sign-On (SSO) configuration page.

User profile

Your users are allowed to change their TalentLMS profile information (first name, last name, email, and username), but that is strongly discouraged. Changing the first name, last name, and email will only affect their current session.

Next time the user signs in, those values are pulled from your IdP server and replace the altered ones. Changing the username results in user mismatching, since your TalentLMS users are matched to your IdP users based on the username value.

We recommend that you notify your users of how the SSO process affects your TalentLMS domain and advise them to avoid changing their first name, last name, email, and, most importantly, their username on their TalentLMS profile.

When your users are authenticated through SSO only, it’s considered good practice to disable profile updates for those users. To do that, go to Account & Settings > User Types > Learner-Type > General > Profile and (if checked) uncheck the Update and Change password permissions.