Please note that if you have more than one Academy, you will need to go set up SSO separately for each Academy. Academies cannot share the same SSO setup.
Setting Up the WorkRamp app for Academies in Okta
The regular WorkRamp app available in Okta is for our internal application. You will need to set-up a custom SAML for your WorkRamp Academy.
Start at Applications and click [Add Application].
For Platform, select "Web" and Sign on method, select SAML 2.0.
When in Step 2 Configure SAML, enter the following information:
-Single sign on URL: URL_OF_ACADEMY/saml/consume
-Audience URL (SP Entity ID): URL_OF_ACADEMY/saml/metadata.
For Name ID format, select "EmailAddress"
Setting up SSO in your Academy
Navigate to your Academy Settings and select 'Registration'.
Uncheck the box for "Allow Registration via Username and Password" and check the box for "Allow Registration via SSO."
Note: If you would like to allow users to register using either username + password or SSO, you can check the box for both registration options.
In the SSO Type drop down menu, select "SAML".
You will need to provide three pieces of information (these values are available from Okta after you have completed setting up the WorkRamp application in Okta):
Identity Provider Issuer - A URL that uniquely identifies your SAML identity provider. For Okta customers, it is formatted as:
http://www.okta.com/[ID from SSO sign-in url]
Single Sign-On URL - This is the SSO URL that WorkRamp will direct your users to when they access your Academy.
For Okta, it could be formatted as: https://COMPANYNAME.okta.com/app/workramp/[ID]/sso/saml
Certificate - This is the certificate WorkRamp will require to verify your users identity during the sign on process. This should be provided by your SSO provider. If you have any trouble finding this certificate, contact your SSO provider or the WorkRamp team.
Running an SSO Test
Once you have finished adding your SAML Settings, we recommend running a quick test to make sure it works.
IMPORTANT: Make sure you run this test in an incognito window or a separate browser.
You should also run this test during non-peak hours or for a short period of time. This will lock out any users if the configuration is not set up properly.
Locking Custom Registration Fields
If you are syncing over Custom Fields via SSO and do not want users to be able to manually edit these fields, you can lock the fields using the "Locked" checkbox for the field on the Registration Settings page.
