Integration Lab

Documentation · Identity

Set Up Your First Federated SSO Integration

Map a trusted identity to an existing or Just-in-Time candidate.

Verified
Purpose
Map a trusted identity to an existing or Just-in-Time candidate.
Prerequisites
  • Administrator access to both applications
  • Server-side secret storage
Architecture
Integration Studio represents the external client or LMS. API Exams App represents the assessment provider. Exam Player is the candidate-facing browser application.

Configuration

Candidate join keyUse the configured immutable external ID claim
JITCreates/maps a candidate during the trusted federated flow when enabled

Implementation steps

  1. 01Activate an OIDC/Federated SSO scenario.
  2. 02In API Exams → Integration Clients → OIDC / Federated SSO configure issuer, client ID, redirect URL, external ID claim and JIT.
  3. 03Match Studio’s SSO connection values.
  4. 04Start the launch and follow the simulated OIDC redirect.
  5. 05API Exams validates issuer, audience, state, nonce and claims, then creates the candidate session.
  6. 06With JIT enabled an unknown trusted identity is created; otherwise it must already exist.

Testing procedure

  • Candidate reaches Exam Player without a separate provider login
  • Expected identity is shown

Troubleshooting

Identity not mapped

Check the external ID claim and JIT setting on both the scenario and Integration Client.