Single sign-on and identity provider integrations
Learners and admins sign in to Intellum with the corporate identity your organization already manages, through SAML 2.0, OAuth 2.0, OpenID Connect, LDAP or ADFS. IT and an Intellum admin set it up with Intellum.
Common uses of single sign-on
- IT routes sign-in through Okta, Microsoft Entra ID or OneLogin, so access to learning follows the same policy as other tools.
- Admins skip manual account setup, since accounts can be created the first time a person signs in through SAML or OAuth.
How single sign-on works
People sign in through the identity provider your organization already runs. Okta and OneLogin connect through SAML or OpenID Connect. Microsoft Entra ID and Active Directory use LDAP, ADFS or SAML. Google Workspace accounts use Google sign-in, and Personify connects through native single sign-on. Any identity provider that supports SAML 2.0 or OpenID Connect works too.
At sign-in, the identity provider passes an email or identifier to Intellum. Accounts can be created at first sign-in through SAML or OAuth. Admins remove accounts through the API or a recurring user file.
How to set up single sign-on
IT connects your identity provider, and an Intellum admin sets up sign-in for your site with Intellum.
- An identity provider that supports SAML 2.0, OAuth 2.0, OpenID Connect, LDAP or ADFS
- An email or other identifier your identity provider sends for each person
- A plan for removing accounts through the API or a recurring user file
How single sign-on to Intellum handles access and data
- Authentication: SAML 2.0, OAuth 2.0, OpenID Connect, LDAP or ADFS between your identity provider and Intellum.
- Data: sign-in passes an identity assertion, such as an email or identifier, that identifies the person.
- Accounts: accounts can be created at first sign-in through SAML or OAuth. Admins remove accounts through the API or a recurring user file.
What to know about single sign-on
- Account removal runs through the API or a recurring user file, so build it into your offboarding steps.
- Bulk user imports accept an OAuth provider value and a user ID, so imported users match the accounts they sign in with.
Questions about single sign-on
Intellum supports SAML 2.0, OAuth 2.0, OpenID Connect, LDAP and ADFS for single sign-on. Learners and admins sign in to the LMS with the corporate identity your organization already manages.
Yes, at first sign-in. Accounts can be created the first time a person signs in through SAML or OAuth, so admins don’t set each one up by hand. Admins remove accounts through the Intellum API or a recurring user file.
Okta and OneLogin connect through SAML 2.0 or OpenID Connect, and Microsoft Entra ID and Active Directory connect through SAML 2.0, LDAP or ADFS. Personify connects through native single sign-on, and any identity provider that supports SAML 2.0 or OpenID Connect can connect.
Single sign-on lets learners and admins sign in to the LMS with the corporate credentials they already use. In Intellum, your identity provider passes an email or identifier at sign-in, and that identifies the person.
IT runs sign-in to learning through the identity provider it already manages, so access follows the same policy as your other apps. Learners use credentials they already have, and admins skip manual account setup.
See single sign-on working with your stack
Walk through this integration, and the questions IT will ask, with an Intellum expert.