Applies to: Pro, Plus, & Enterprise Plans

Introduction

The main purpose of establishing a Single Sign On (SSO) process with Absorb is to allow your users a single point of entry into your system while providing them access to multiple other independent systems. With this process a user logs in with a single ID to gain access to a multitude of other systems without being prompted for different usernames and passwords.

This article discusses Incoming SAML 2.0 SSO for clients using Active Directory Federation Services (ADFS) and presents a somewhat abridged and focused version of our full Incoming SAML 2.0 Single Sign-On article. For the purposes of this article the Absorb system will act as the Service provider (SP). Your ADFS system will act as the Identity Provider (IdP). 

Please note that SSO is an additional feature that usually involves an additional fee and technical resources on the client side to develop and/or configure the solution.

Disclaimer: Absorb LMS supports Incoming SAML 2.0 Single Sign-On as a feature, however we do not officially support any specific client-side (IdP) solution. Although ADFS is known to generally work with our implementation of SAML SSO, it is the client's responsibility to configure/develop and maintain their side of the integration. This will require a client resource who is knowledgeable and familiar with your particular ADFS environment. This guide is provided to our clients as a convenience only, based on our past experience working with clients who employ ADFS. 

Contents:

• Introduction
• Absorb Setup
• ADFS Setup
• Metadata
• Deep Linking & RelayState

Absorb Setup

The following variables will need to be determined and configured as part of your SSO implementation.

With the exception of Portal URL and RelayState, all of the above variables can be configured by logging into the Absorb admin portal as a System Admin and navigating to Portal Settings. 

From Portal Settings, there is a button in the right-side context menu labelled Manage SSO Settings. If you can't see this button, please contact your Absorb Client Success Manager to discuss enabling the feature.

Once you have clicked the button, you will be brought to the Manage Single Sign-On Settings page. Any existing configurations will appear here, as well as the option to Add a new one. 

Each route (Portal URL, e.g. company.myabsorb.com) can have its own set of SSO configuration. Please see this article for more information on route-based SSO. The remainder of this article assumes we're talking about a single SSO configuration.

You may import the following metadata to speed up your setup process in ADFS, though it's usually a good idea to manually check all of the items in the ADFS Setup section.

Absorb's SP Metadata

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor entityID="https://company.myabsorb.com" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
<md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MIIDjjCCAnYCCQCa+e+SzqyqUTANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCQ0ExEDAOBgNVBAgMB0FsYmVydGExEDAOBgNVBAcMB0NhbGdhcnkxIjAgBgNVBAoMGUJsYXRhbnQgTWVkaWEgQ29ycG9yYXRpb24xEzARBgNVBAsMCkFic29yYiBMTVMxHDAaBgNVBAMME0Fic29yYiBMTVMgU0FNTCBTU08wHhcNMTQxMTAzMjEyNzQwWhcNMjQxMDMxMjEyNzQwWjCBiDELMAkGA1UEBhMCQ0ExEDAOBgNVBAgMB0FsYmVydGExEDAOBgNVBAcMB0NhbGdhcnkxIjAgBgNVBAoMGUJsYXRhbnQgTWVkaWEgQ29ycG9yYXRpb24xEzARBgNVBAsMCkFic29yYiBMTVMxHDAaBgNVBAMME0Fic29yYiBMTVMgU0FNTCBTU08wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDICYSrMPKo1Wn6Owqst6JN+klfyWigtfOfjNtkqFj065840+SYYPUw3PTdyanSYZJ8PYl8JRfgMmfBTxyVoFJU4rCvhVei/gkHwovngX+cAzYo+cBABm1dG9oBky0wi8qUjoauByWQ74npjtmwAfhv1/r5rRv7LdpkTxpZ5Llz772uHFOobvC4hRt13Z7hKkhiuQ7ZE5/IBbjXjgMYFDgMg9iMZ0qsKlDPK+sSi+DAJRtvZhscCDBFeThf64YM92TIAUgG3MPQs7BvzI/rWea4UC5TfRekA7F/hmaXqh/Vy2LWPKXzFKZ4tjCP6u+Q/rycxsx9dlGY2LMM6pWtzyEHAgMBAAEwDQYJKoZIhvcNAQELBQADggEBACXgA3cIpNZ9jlHH+vU/6+2h5y/ps72fdULbbX5EPhcyHugyn7gFz7LQgq5PE8Ufbh7rggegAuB0VaMC1gYvfr2xsusQi+XekWD1wEiwYl8WavTbvildUweBTMHgKWAqsbvDdYyUgcgk6NG2myrnVrGtz+1fh4TqswnkoA9c0XOYnXvOB/mG79GrnPgPoLTl/21pr1ewJ4NBY3/BJAnYtATZbmP5zPvZs6oSt0Ds652oN+eA1CfU1Ys+n0vZI1f9IkMfClcY1X78/9AtRxIUKXhmt5gN2lKQsyr8QKgzwQmtuXVt2Qz10GzsJRFX5Ly2Ocqu8bQ2AY+G5rlnCY1tW4Q=</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://company.myabsorb.com/account/saml" index="0" isDefault="true"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>

Please ensure you replace "company.myabsorb.com" with your Portal URL. You can add the Absorb metadata to your list of trusted Service providers if required.

IdP Metadata

You may have already exported the certificate manually in the ADFS Setup section above, but your IdP Metadata can also be used to obtain your public X509 certificate. The X509 certificate should be added to the Key field under Portal Settings in Absorb.

Deep Linking & RelayState

Deep linking in terms of the Absorb LMS is the ability to redirect a user to a particular user content page on the Absorb LMS. Please see the Deep Linking and RelayState section in the main SAML 2.0 SSO article for a full list of supported deep links with SAML SSO.

The following are examples of deep links formulated using your ADFS IdP login URL and the RelayState variable. Note that the red highlighted portions are course and lesson GUID's that should be retrieved from your Absorb admin portal. Also note the use of URL encoding for the included parameters.

Jump back to top.