SSO URLs

We go about it in what sounds like much the same way. The SSO redirects users to the IDP for authentication, and we then provide end users with links that include the return action and the desired content. For example:

https://chris.thoughtindustries.com/access/saml/login/chris-pano-slug/?returnTo=/learn/article/challenger-introduction

When a user follows this link, they are redirected to their SSO for authentication and then taken directly to the specified content. As long as the user remains logged in, they can continue using direct SSO URLs without needing to login through the IDP each time.

Since we use Panorama’s for all our clients we leverage the API to list all the content that has been made available and then generate a SSO deep link URL for each item via a scripted process.  

@Christopher.Hernley This is what we want to do. Can you speak more to exactly how that link is created? Did someone on your engineering team set up something internally that creates that SSO link for the content? 
I am missing something in my understanding of how the link is created behind the scenes! 

​@Christopher.Hernley 
This is SUPER helpful. I am not sure I am grabbing the right slug though. We aren’t exclusively using SSO for access...some of our users continue to have to create a login to access content. 

I’d love to meet and chat if you have a few minutes! I am on EST (East Coast of US) and am available this afternoon at 3 pm or tomorrow anytime except 11-11:30. lisa.rollins@uniteus.com 

Thank you! 

I worked directly with the highest tier Customer Success team to work through multiple issues we had very similar to this. Everything outlined so far in this post worked for us for most scenarios, however we still found an issue when a user would click a link that points directly to a course. If the user does not already have a session in TI, then building a custom returnTo URL as outlined above works. However, if the user already has an active session, the TI redirect logic adds an extra “client” GET parameter specifying the panorama, and ends up landing the user on the actual login page instead of sending them to the course.

We finally found a solution that worked no matter the current state of the user’s session in TI. If you link directly to a course using the course ID instead of the /path/to/course, it works every time for us. When you’re editing a course, the course ID is available in the address bar. It’s also available from the Content API. You can then use a URL like this:

https://yoursite.thoughtindustries.com/learn/enroll/3bb6407b-7a9a-4335-ad00-a4fd33c80385

Where “3bb6407b-7a9a-4335-ad00-a4fd33c80385” is the course ID, then the user will be automatically redirected to SSO for login, and if they already have a session they will load the course immediately. You will need to have the External Login URL configured as:

https://yoursite.thoughtindustries.com/access/saml/login?returnTo={{returnTo}}

Thank you! ​@astclair 
Super helpful!!

Adding to this thread for what worked for me, and a huge shoutout to ​@LisaRollins  for pointing me in this direction.

I work primarily on internal content so we use the same panorama for everything. There is another team that works on external and uses different panoramas. However, if you use a single pano and everyone in that pano has to use some form of SSO auth to get in, then this can work for you.

Christopher.Hernley’s breakdown is accurate, the only thing that I had to change was what came after the “?returnTo=”. If I just did /learn/course/course_slug , it would take me to a page not found. But if I appended the site URL before the /learn, it worked.

Tha​@astclair  for the clarification and it gave me the idea of using the whole course “Detail Page” url, or “Enroll URL” from the learner dashboard and both worked. Now I can build out a spreadsheet that will automatically generate these links for me and my team to use.

Thank you to all for the info here, you’ve saved me hours of research and self-testing!

​@Christopher.Hernley When we spoke, I mentioned that I was going to split my panorama into two - one for SSO users and then one for those users who we need to login. 

You mentioned something about deep linking for the login users, but I didn’t capture what I needed to do. 

I would like to create links to the login panorama courses that will take them to the login page first, then when they login redirect them to the course detail page to register.

Any thoughts on how I should do those links? 

Thanks...and if anyone has the answer, I’d appreciate it! 

Hi ​@LisaRollins 

For a deeplink and username and password login you should be able to format links in the following way with the enroll/courseid ending 

https://hub.challengerinc.com/learn/enroll/60aef0f2-6bdd-486d-b663-1d6205c74be5

this should first direct the user to the login page, and then to content 

​@Christopher.Hernley You are my hero today!! Thank you so much, this worked perfectly! 

Now, my next question for everyone is, can I get this to work for VILTs that have multiple sessions to take users to the detail page to choose their session rather than just enroll them in a single session?

When I try using the courseid from the first session with this as the start /learn/enroll/ it just tells me that session has passed. 

Hi ​@LisaRollins were you able to solve this for VILTs? We did some testing with ILTs but weren’t successful. Would love to know how to make this work for those events!