Before getting started with the setup in WorkRamp, please reach out to Impartner to request a unique Certificate to be used for your specific Academy.
They will also need to configure the following as the backend setup:
entityID = [Impartner URL]/auth/saml2/idp/sso.ashx?target=workramp
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="[Impartner URL]/auth/saml2/idp/slo.ashx"/>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="[Impartner URL]/auth/saml2/idp/sso.ashx?target=workramp"/>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="[Impartner URL]/auth/saml2/idp/sso.ashx?target=workramp"/>
Setting up SSO in your Academy
Navigate to your Academy Settings and select 'Registration'.
Uncheck the box for "Allow Registration via Username and Password" and check the box for "Allow Registration via SSO."
Note: If you would like to allow users to register using either username + password or SSO, you can check the box for both registration options.
In the SSO Type drop down menu, select "SAML".
You will need to provide three pieces of information:
Single Sign-On URL: [Impartner URL]/auth/saml2/idp/sso.ashx
Identity Provider Issuer: [Impartner URL]/auth/saml2/idp/sso.ashx?target=workramp
-
Certificate: This will be the unique Certificate you requested from Impartner
You can get the correct Certificate by navigating to: https://$HOSTNAME/auth/saml2/idp/metadata.aspx
(This will produce an XML response, look for the X509Certificate)
Make sure to check the box for "Signed SAML Auth Requests."
Running an SSO Test
Once you have finished adding your SAML Settings, we recommend running a quick test to make sure it works.
IMPORTANT: Make sure you run this test in an incognito window or a separate browser.
You should also run this test during non-peak hours or for a short period of time. This will lock out any users if the configuration is not set up properly.
Locking Custom Registration Fields
If you are syncing over Custom Fields via SSO and do not want users to be able to manually edit these fields, you can lock the fields using the "Locked" checkbox for the field on the Registration Settings page.