Identity
Single sign-on (SSO)
Members sign in with your identity provider, over OpenID Connect or SAML 2.0.
SceneSnap supports OpenID Connect (OIDC) and SAML 2.0. Prefer OIDC unless your identity provider (IdP) only offers SAML.
Your IT team configures the application in the IdP. SceneSnap reviews the configuration and activates the provider for your organization.
How sign-in works
- On the sign-in page a member enters their work email. The domain chooses your provider.
- After a successful sign-in the member belongs to your organization. Membership comes from the provider account, not from the domain typed in the browser.
- An email domain belongs to one provider only.
OpenID Connect
Create a regular server-side web application, not a single-page application: SceneSnap exchanges the code with a client secret on its server.
| Setting | Value |
|---|---|
| Callback (redirect) URL | /api/auth/sso/callback/<provider-id> on the SceneSnap domain. SceneSnap sends you the exact URL. |
| Flow | Authorization code, with PKCE |
| Scopes | openid email profile offline_access |
Claims SceneSnap reads, from the ID token or UserInfo:
| Claim | Used for | |
|---|---|---|
sub | Required | The person's identifier. Must stay the same for life: never an email that can change. |
email | Required | Sign-in address and contact |
email_verified | Optional | Provider verification information. Whether it is trusted depends on the provider configuration. |
name | Recommended | Display name. Send the name you want members to see. |
picture | Optional | Profile image. Use an HTTPS URL. |
If your IdP uses other claim names, SceneSnap can map them.
SAML 2.0
| Setting | Value |
|---|---|
| ACS URL | /api/auth/sso/saml2/sp/acs/<provider-id> on the SceneSnap domain |
| SP metadata | /api/auth/sso/saml2/sp/metadata?providerId=<provider-id> on the SceneSnap domain |
Assertions must be signed, with SHA-256 or stronger. Each one carries a stable NameID, the email and the display name. Take the audience and ACS URL from the SP metadata SceneSnap sends you.
What to send SceneSnap
- The email domains your members sign in with.
- For OIDC: the discovery URL, client ID and client secret. For SAML: your IdP metadata.
- A technical contact for the sign-in test and for future secret or certificate rotations.
Send secrets and keys only through the secure channel SceneSnap gives you, never by email, ticket or chat.
Data exchanged
Your provider sends the person's stable identifier, email and configured profile attributes. SceneSnap sends the authentication request and callback information; with OIDC it also exchanges the authorization code for tokens and can request UserInfo. SSO does not send course activity or quiz results to your provider.
Good to know
- Keep
sub(or the NameID) stable when you rotate secrets or update the application. A new value for the same person can create another account or prevent the expected account from opening. Coordinate identifier changes with SceneSnap. - Rotate secrets and certificates before they expire, and tell SceneSnap in advance so the new one can be tested.
- A regular SceneSnap sign-in lasts up to 30 days without renewal. Disabling sign-in in your IdP does not by itself end a SceneSnap session that is already open.
- SSO controls authentication. To create members ahead of their first sign-in and deactivate them when they leave, add SCIM.
- With SCORM account linking, learners can link their LMS profile to their SSO sign-in.