This article explains how to setup and use Thinkific's SSO (Single Sign On) feature to sign into your Thinkific school from your website.
About This Feature
OpenID Connect (OIDC) SSO (Single Sign On) allows you to connect your identity provider to Thinkific and provide a seamless, logged-in experience for users when navigating between your primary experience and your Thinkific site.
This approach uses the Open ID Standard which is a popular standard that is supported by many of the most common Identify Providers on the Market.
How it works
OIDC SSO is straightforward to connect and configure, and requires a minimal technical skillset. Once connected, this SSO will allow your identity provider to send users from your primary application and sync their information into Thinkific. This will allow your users to login automatically without the need to manage another password.
During configuration, you will also be able to define sign up, sign in, and sign out URLs which automatically adds redirects from these default views in Thinkific to your location of choice. This allows your experience to stay consistent for all of your users and to keep user access control in your identity provider.
How to set it up
Step 1: Install the OpenID Connect SSO App into your Thinkific site.
- Navigate to OIDC SSO in the Thinkific App Store.
- Ensure that you are logged into the Thinkific site that you would like to install the app on.
- Once you press the install button you should review and accept the information about the app on the consent page.
- Once installed, you will be directed to the configuration screen for the next step!
Step 2: Configure your OpenID Connect SSO App
- After installing the App, complete the required fields in the OpenID Connect Settings form with data from your identity provider.
The relevant fields include:
Field Where to find it Issuer
Get this from your identity provider
Client ID Get this from your identity provider Authorization Endpoint Get this from your identity provider Token Endpoint Get this from your identity provider Sign-up URI The URL you would like to redirect the user to when they use the sign up/sign in functions in Thinkific. Logout URI The URL you would like to redirect the user to when they log out of Thinkific.
- Press Save to complete your setup in Thinkific.
- Finally, copy the Provided Callback URL and paste it into the list of allowed callback URLs in your Identity Provider.
Step 3: Test your OIDC Configuration
Now that you have configured your OIDC SSO, test the connection to ensure that it effectively logs you into a Thinkific user account.
- Open an incognito or private window in your browser.
- Navigate to your Thinkific site and click Sign In. See that you are now redirected to your chosen Sign Up URL.
- If you are using an identity provider such as Auth0, upon successful login your browser should redirect back to your Thinkific site with a logged in user!
- If you do not see yourself automatically redirected back to Thinkific, you should make sure your identity provider is using the correct callback URL, which can be found at the top of your configuration settings.
Step 4: Complete any other necessary configuration
While this OpenID SSO handles login and user access to your site, you will still need to determine how you will provide your users access to your communities, courses and other content.
There are a number of options to do so, including automatically enrolling them in a course or bundle via the Thinkific API.
Supported Identity Providers
OpenID Connect is a popular SSO standard and is supported by a number of common identity providers. Specifically, it is known to support identity providers including Okta, ActiveDirectory, and AWS Cognito.
Any Identity provider that supports OpenID Connect will also be compatible with Thinkific so long as they support the following requirements:
- Support for the the standard claims required in the OpenID Connect ID Token:
- given_name - required
- family_name - required
- email - required
Support for the the standard claims require in the OpenID Connect ID Token:
- Support for "client_secret_basic" auth.
- Support for the "authorization_code" flow.
Other SSO Options
OpenID Connect is a very common and straightforward approach to implementing Single Sign On, but may not always be supported in all situations. If you find that this is not an option for you, there are a few alternatives that you may be able to explore:
- Use our Custom SSO Implementation. This is approach uses a custom implementation of SSO based on JWT, but is non standard so will require development work in order to properly configure and connect. If you'd like to learn more about this, check out our developer documentation.
- Hire a solution like miniOrange to help build and develop your customer SSO Implementation. They have worked with a number of Thinkific creators in the past to connect Thinkific to other options and they provide great flexibility when it comes to SSO.