Single Sign-On (SSO)
SSO lets your users sign in with their existing company accounts (Google Workspace, Microsoft, Okta, etc.) instead of creating a separate password for the LMS.
Techarix LMS supports two protocols:
- OIDC (OpenID Connect) — works with Google, Okta, Auth0, Keycloak, and most modern identity providers
- SAML 2.0 — works with Microsoft Azure AD, ADFS, and enterprise identity providers
Set up SSO
- Go to Settings → SSO
- Toggle Enable SSO to ON
- Select your Protocol (OIDC or SAML)
- Fill in the fields for your identity provider (see below)
- Click Save, then Test Connection
OIDC setup
| Field | Description |
|---|---|
| Discovery URL | Your IdP's OpenID Connect discovery endpoint (ends in /.well-known/openid-configuration) |
| Client ID | Application client ID from your IdP |
| Client Secret | Application client secret from your IdP |
| Scopes | Leave as openid email profile unless your IdP requires different scopes |
Common discovery URLs
| Provider | Discovery URL |
|---|---|
https://accounts.google.com | |
| Okta | https://your-domain.okta.com/oauth2/default |
| Microsoft | https://login.microsoftonline.com/{tenant-id}/v2.0 |
| Auth0 | https://your-domain.auth0.com |
| Keycloak | https://your-keycloak/realms/{realm} |
Redirect URI to configure in your IdP
The exact redirect URI for your organization is shown on the Settings → SSO page once you select OIDC. Copy it from there and paste it into your IdP application settings.
SAML 2.0 setup
| Field | Description |
|---|---|
| IdP Entity ID | Your identity provider's entity ID (from their metadata XML) |
| IdP SSO URL | The URL the platform redirects users to for login |
| IdP Certificate | X.509 certificate from your IdP (PEM format) |
| IdP Metadata URL | Optional — if your IdP provides a metadata URL, paste it here |
SP details to configure in your IdP
Your organization's exact SP values are displayed on Settings → SSO once you select SAML. Copy each value directly from that page:
| Setting | Where to find it |
|---|---|
| Entity ID | Shown on the SSO settings page under "Service Provider Details" |
| ACS URL | Shown on the SSO settings page — this is where your IdP posts the SAML response |
| Metadata URL | Shown on the SSO settings page — some IdPs can auto-configure from this URL |
Attribute mapping
The platform maps claims from your IdP to user profile fields.
| Platform field | Default OIDC claim | Default SAML attribute |
|---|---|---|
email | email | |
| First name | given_name | given_name |
| Last name | family_name | family_name |
| Role | (not mapped by default) | (not mapped by default) |
If your IdP uses different attribute names, update them under Attribute Mapping in the SSO settings.
User provisioning
Auto-provision new users — when enabled, users who sign in via SSO for the first time are automatically created in the platform. Disable this if you want to manually create user accounts before they can log in.
Default role — the role assigned to auto-provisioned users (default: Student).
Allowed email domains — restrict SSO login to specific domains (e.g. yourcompany.com). Leave blank to allow any email address that your IdP authenticates.
Enforce SSO
When Enforce SSO is enabled, the password login form is hidden and users must log in via SSO.
Even with SSO enforced, admins can always access the password form via a "Sign in with password" link at the bottom of the login page — this is a recovery mechanism in case SSO is misconfigured.
Test your SSO configuration
After filling in the settings, click Test Connection to verify:
- For OIDC: the platform fetches the discovery document and confirms the IdP is reachable
- For SAML: the platform validates the certificate format
A successful test does not perform a full login — it only validates the configuration. Test a real login by opening your subdomain in an incognito window and clicking Sign in with SSO.