Setting up Single Sign On

Trakstar Learn supports SAML 2.0 Single Sign-On (SSO), allowing users to authenticate through your organization's Identity Provider (IdP). Learn acts as the Service Provider (SP) and sends authentication requests to your IdP to verify users before granting access to their Learn account.

Requirements

Before you begin, ensure you have:

  • A supported SAML 2.0 Identity Provider (IdP), such as:
    • Okta
    • Microsoft Azure / Microsoft Entra ID
    • Salesforce
    • Google Workspace (formerly G Suite)
    • Feide
    • Any custom IdP that supports the SAML 2.0 standard
  • Administrative access to your Identity Provider.
  • Access to your Trakstar Learn account.
  • The information listed below before contacting Trakstar Learn Support.

Information Required for Setup

Provide the following information when requesting SSO configuration:

Required Information Description
Service Provider-Initiated Redirect URL The URL where Learn sends the initial authentication request. It must support the SAML Redirect (HTTP GET) protocol and return a POST response to the Assertion Consumer Service (ACS) URL.
IdP Issuer The unique identifier representing your Identity Provider.
IdP Public Certificate An X.509 public certificate used by your IdP to sign SAML assertions. Do not send your private key.
Service Provider Issuer (SP Entity ID) Defaults to https://<subdomain>.learn.trakstar.com , although it can be overridden if required by your IdP.
Login Button Text (Optional) Custom text displayed on the Learn login page. The default is Login with company credentials.
Login Button Graphic (Optional) A custom login button image measuring 201 × 86 pixels, with the top half representing the default state and the bottom half representing the hover state.

Reference Values

Use the following values during configuration:

Setting Value
Assertion Consumer Service (ACS) URL https://<subdomain>.learn.trakstar.com/saml/acs
SP Entity ID https://<subdomain>.learn.trakstar.com

Configure the Assertion Consumer Service (ACS) URL

The standard ACS URL is:

https://<subdomain>.learn.trakstar.com/saml/acs

With this configuration:

  • Your IdP must return the RelayState value received in the authentication request.
  • For IdP-initiated logins, the Learn Account ID must be included as the RelayState value.

Alternatively, you can configure the ACS URL using your Learn portal subdomain (for example, https://acme.learn.trakstar.com/saml/acs ). With this approach, RelayState is not required.

User Authentication Methods

During authentication, your Identity Provider must send one of the following identifiers in the Subject field of the SAML response:

Authentication Method Description
User ID The Learn internal user ID. Often synchronized using the Learn API.
Email Address The user's email address must exactly match the email stored in Learn.
Username The Learn username associated with the user account.
Federated ID A unique external identifier stored on the user's Learn record.

Authentication succeeds only when the identifier sent by the IdP matches the corresponding value stored on the user's Learn account.

Next Steps

Once you have your Federation Metadata, share the certificate in an XML file with the Trakstar Learn support team. After configuration is complete, test the integration with at least one user so any issues can be identified and resolved promptly.

IDP Specific Documentation

Enable Automatic User Provisioning with Single Sign-On

Trakstar Learn can automatically create user accounts the first time a user successfully signs in using Single Sign-On (SSO). This feature is known as automatic user provisioning.

Before You Begin

To enable automatic provisioning:

  1. Contact the Trakstar Learn support team and request that automatic user provisioning be enabled for your Learn account.
  2. Configure your Identity Provider (IdP) to include the required user attributes in the SAML response.

Required SAML Attributes

Your Identity Provider must send the following attributes:

AttributeDescription
emailaddress The user's email address
givenname The user's first name
surname The user's last name

These attributes are required for Learn to create the user account during the user's first successful SSO login.

Complete the Configuration

After:

  • Automatic provisioning has been enabled for your account,
  • The required SAML attributes have been configured, and
  • Your Identity Provider has been fully configured,

the Trakstar Learn team can complete the SSO integration.

It is recommended that an administrator or test user signs in immediately after setup so the configuration can be verified and any issues can be resolved quickly.

Still need help? Contact Us Contact Us