How SSO and Auto-Provisioning Work
Skyllful supports single sign-on from more than one identity provider in the same Learning Program, so employees and contractors train together while each signs in through their own organization, and auto-provisioning can create their user account on first sign-in with the manager, job role, and tags they should have.
What is single sign-on in Skyllful?
Single sign-on lets people reach their training with the credentials they already use at work, rather than a separate Skyllful username and password.
For a Learner, it means one less password to forget. For you, it means access follows the accounts your organization already manages: when someone joins or leaves, the system your IT team already runs is the one that decides.
Skyllful supports single sign-on alongside Skyllful Authentication, and the choice is made per person on their user record. A Learning Program can hold both kinds of user at once.
Can one Learning Program use more than one identity provider?
Yes. A single Learning Program can accept sign-ins from multiple identity providers at the same time.
This matters more than it sounds. Plenty of organizations need to train people who are not on their own directory: contractors, franchisees, dealers, staff from a recently acquired business, or partners who work alongside employees. Without this, each of those groups either gets its own separate Learning Program, which fragments reporting and doubles the content management, or they get Skyllful usernames and passwords, which is the thing single sign-on exists to avoid.
Instead, everyone trains in one Learning Program, on the same content, in the same reports, while each person signs in through whichever organization actually manages their identity.
Note: Because each provider sends its own claims, the auto-provisioning rules described below are what keep the groups apart once they are in. A rule can give contractors a different manager, a different job role, and their own tag, based on the provider they arrived through.
What is auto-provisioning?
Auto-provisioning creates a person's Skyllful account the first time they sign in, instead of waiting for an administrator to add them.
Without it, single sign-on still works, but somebody has to add each person to the Learning Program first, and a person who has not been added cannot get in. With it, the account is created at the moment it is needed.
Note: Auto-provisioning is configured per Learning Program. A person who signs in to two programs is handled by each program's own rules.
What does auto-provisioning decide?
A new user cannot be created out of nothing, so auto-provisioning has to answer three questions about every person it lets in.
Setting |
The question it answers |
|---|---|
| Default Assigned Manager | Who does this person report to? |
| Default Assigned Role | Which job role do they have? |
| Tags To Add To User | Which tags should they arrive with? |
Manager and job role are not optional extras. Both are required for anyone with Simulator access, and only a user with Skyllful IQ access can be a manager, so these are the values that decide whether a new Learner arrives usable or broken. See User Permissions.
How does it decide, when people are different?
Your identity provider already knows things about each person: their department, their title, their location. It sends those details along with the sign-in as claims.
Auto-provisioning reads those claims and acts on them. Each of the three settings can hold a list of rules, and each rule is the same shape:
> If this claim has this value, then assign this manager, role, or tag.
Warehouse staff can go to one manager while office staff go to another, and neither is touched by hand. A rule can also match any value of a claim, when the presence of the claim is what matters rather than what it says.
Underneath the rules sits a Default. Anyone no rule matched gets whatever the Default specifies, so nobody arrives without a manager or a role. The simplest working configuration is defaults alone, with no rules at all.
Who sets this up?
Not administrators, and not in Studio.
Piece |
Who configures it |
|---|---|
| The connection between Skyllful and your identity provider | Skyllful, working with your IT team. |
| The auto-provisioning rules | Skyllful, working with your IT team. |
The settings live on the SSO Management tab of Learning Program Settings, so you may be able to see them. Changes to them are made with your Skyllful team rather than on your own, because a rule that points at the wrong claim produces users nobody can use.
What will your organization need to decide?
The conversation goes faster when you arrive with answers to these.
Question |
Why it matters |
|---|---|
| Which identity provider(s) do you utilize? | One Learning Program can use several, so contractors and partners do not need a program of their own. |
| Which claims does each provider send, and what values do they carry? | A rule can only match a claim that actually arrives. Your IT team has this. |
| Who should new people report to by default? | This becomes the Default manager, and they need Skyllful IQ access. |
| Which job role should new people get by default? | The role must exist in the Learning Program first. |
| Should any group get something different? | Each exception becomes one rule. |
| Should new people arrive tagged? | Useful if you group Learners for assignments. |
FAQ
Do we have to use auto-provisioning to use single sign-on?
No. They are separate. Single sign-on works without it; auto-provisioning saves you from adding each person before their first sign-in.
Who do we talk to about turning this on?
Your Skyllful contact. Skyllful and your IT team configure it together.
What happens to someone no rule matches?
They get the Default manager, role, and tags.
Can we use more than one identity provider in one Learning Program?
Yes. Employees, contractors, and partners can each sign in through their own organization while training together in the same Learning Program, and auto-provisioning rules can give each group different access.
Can two Learning Programs treat people differently?
Yes. The rules belong to the Learning Program.
Can we change what an auto-provisioned person received?
Yes. Once the account exists it is an ordinary user record and can be edited like any other. See Edit User Profile.
Can everyone in the organization sign in this way?
Only people your identity provider sends to Skyllful. Access is still decided by the systems your IT team already manages.
Skyllful Knowledge Base | Administrators