---
title: SSO Integrations
slug: sso-integrations
createdAt: 2025-03-23T18:20:43.585Z
---

The **SSO Integrations** section allows institutions to manage how ampEducator connects with external systems for secure authentication using OAuth 2.0 and OpenID Connect (OIDC). These tools make it possible for users to sign in using existing accounts from supported providers — or for ampEducator itself to serve as an identity provider for other platforms.

![](https://api.archbee.com/api/optimize/dAaYdF15xm67t_NLKoQQv/4QaIk255FRQ8zrk7LWzGL_image.png)

This area is designed primarily for IT administrators or technical staff who manage authentication and integrations. It contains two parts:

- **External Identity Providers (OAuth)** – Configure external OAuth 2.0–enabled login providers so users can log in to ampEducator using their existing credentials (e.g., Google, Microsoft). 
- **Connected Applications (OIDC)** – Set up external systems, such as LMS platforms, to use ampEducator as their identity provider.

## External Identity Providers (OAuth)

The **External Identity Providers (OAuth)** section allows institutions to configure external OAuth 2.0–enabled authentication providers so users can log in to ampEducator using existing accounts, such as Google or Microsoft. When configured, ampEducator uses the user’s email address to identify their account during login.

![](https://api.archbee.com/api/optimize/dAaYdF15xm67t_NLKoQQv/ouBI-toRaWh6afvmcOlR8_image.png)

- The **Callback URLs** displayed on this page must be added as valid callbacks in your provider’s configuration. These URLs are specific to your institution and must be entered exactly as shown. 
- ampEducator supports both **3-legged OAuth** and **OpenID Connect (OIDC)** protocols. 
- Supported signing methods: **HS256** and **RS256**. 
- Once a provider is added, you can use the **gear icon** beside it to test the connection and confirm that it’s working properly. 

### Adding a New OAuth Provider

To create a new provider connection, click **New OAuth Provider**. This will open a setup window where you can define the provider details and select between **Open ID Connect** or **OAuth 2.0** as the provider type.

![](https://api.archbee.com/api/optimize/dAaYdF15xm67t_NLKoQQv/KMyGvYw8gpBt_LC4MxLdm_image.png)

- **Provider Type** – Choose between *Open ID Connect* (OIDC) or *OAuth 2.0*. 
  - *Open ID Connect* is an identity layer built on top of OAuth 2.0, typically supporting scopes like openid profile email. 
- **Status** – It’s recommended to keep the provider *Disabled* until it’s been tested successfully. 
- **Name** – The name of the provider (e.g., “Google Sign-In”). 
- **Description** – (Optional) Any notes or context about this connection. 
- **Discovery Document URL** – If the provider supports auto-discovery, enter the discovery URL (usually formatted as https\://{baseURL}/.well-known/openid-configuration) and click **Auto Populate** to automatically fill the endpoint fields. 
- **Auth Endpoint**, **Token Endpoint**, **Client ID**, **Secret Key** – Enter the required credentials provided by your OAuth service. 
- **Scopes** – Defines which permissions to request from the provider. For Open ID Connect, this is typically openid profile email. 

Once all required fields are completed, click **Add** to save the provider. After saving, use the **gear icon** beside the provider to test and verify authentication.

## Connected Applications (OIDC)

The **Connected Applications (OIDC)** section allows institutions to configure external systems to use ampEducator as an **identity provider**. This enables other applications—such as Moodle—to allow users to log in using their ampEducator credentials.

![](https://api.archbee.com/api/optimize/dAaYdF15xm67t_NLKoQQv/_HEyCl0NLGgTAXk-ZLUhu_image.png)

Each external application that uses ampEducator for authentication must have its own **OIDC client** created and configured in this section.

The **Configuration Info** panel lists the URLs and supported parameters your external application will need to connect successfully, including:

- **Issuer URL** – The base URL for ampEducator’s OpenID configuration. 
- **Discovery Doc URL** – Provides details about supported endpoints and capabilities. 
- **Authorization URL**, **Token URL**, **User Info URL** – Standard endpoints for handling user authentication, token exchange, and user data. 
- **JWKS URL** – Lists public keys used by ampEducator to verify signed tokens. 
- **Supported Parameters** – Includes response types, scopes (openid profile email), token authentication methods (Client Secret Basic), and signing algorithm (RS256).

### Adding a New OIDC Client

To connect a new system, click **New OIDC Client**. This opens a modal where you can define the new client and its redirect settings.

![](https://api.archbee.com/api/optimize/dAaYdF15xm67t_NLKoQQv/TWiJ1iGfLKXQQfY2BuJ1u_image.png)

- **Client Name** – A descriptive name for the client (e.g., “Moodle Login”). 
- **Client ID** – A unique identifier that can include letters, numbers, dashes (-), underscores (\_), and periods (.). Spaces are not allowed.
- **Redirect URIs** – One or more redirect URLs for your external application, each on a separate line and beginning with https\://. 

Once the client is added, ampEducator automatically generates a **Client Secret**. You can then use the configuration information displayed above (Issuer URL, Authorization URL, Token URL, etc.) to complete setup in your external application.

Clients can be **edited**, **revoked**, or **restored** as needed.

### Rotate Keys

ampEducator uses cryptographic keys to sign tokens for authentication. These keys can be rotated manually to improve security or when required by your institution’s policy. To rotate your keys, click **More Actions → Rotate Keys**.

![](https://api.archbee.com/api/optimize/dAaYdF15xm67t_NLKoQQv/nwIG5C5jxWfQqtr2X8d4j_image.png)

A new set of keys will be generated and applied automatically, and the **Key Rotation** field in the configuration panel will update to show the most recent rotation date.

:::hint{type="info"}
Key rotation does not affect existing OIDC clients — they continue to function immediately using the new keys. Keys can only be rotated once every 24 hours to ensure stability for existing clients. It’s recommended to rotate keys approximately every six months.
:::