Single sign on (SSO) can be connected to SIRAS user logins via a Google, OneLogin, or other SSO workspace with the following procedure:

1.  In the SSO Provider admin area (Google Workspace, Microsoft Entra, etc), a new SIRAS SSO App will need to be created.  (Add App > Add custom SAML app)

    Parameters for the app should be setup initially to connect to the Training Server URL for testing purposes.  Once testing is complete we will reconfigure this for production.

 

Substitute the appropriate URL below.

 

• VCOE Siras -  Training:  https://sirastraining.vcoe.org - Production:  https://siras.vcoe.org
• Kern Siras - Training:  https://training.siras-kern.org - Production:  https://siras-kern.org
• Main (all other SELPAs) Siras: Training:  https://training.sirassystems.org - Production:  https://sirassystems.org

EntityID
https:/{server URL}/sso/metadata.jsf

Login URL / ACS URL / Recipient

https:/{server URL}/sso/acs.jsf

 

All other parameters blank (Sign on URL, Logout URL)

 

2.  A link or button for this App should be added to the SSO Workspace.  Users will need to access this button via the SSO Provider Dashboard or other district-provided area.  Siras does not usually display a "Login with Google/Microsoft" login page or button, due to the requirement to support many different districts and workspaces.

 

Note: For Microsoft Entra/365, the link is located under Properties > User Access URL and begins with "https://launcher.myapps.microsoft.com/"

3.  SIRAS needs to be configured with these parameters:

 

• EntityID URL: 
  Google Workspaces example - https://accounts.google.com/o/saml2?idpid=abc1234
  Microsoft 365 example - https://sts.windows.net/abc1234/
   
• Single Sign On Service URL 
  Google Workspaces example - https://accounts.google.com/o/saml2/idp?idpid=abc1234
  Microsoft 365 example - https://login.microsoftonline.com/abc1234/saml2
   
• X509 Certificate (file extension .pem or other, base64 format)

4.  Option: restricting user/password access.  If desired we can then disable password-based access to SIRAS for the district, requiring the use of SSO instead.

 

 

Requirements:

• SIRAS User must have the same Email address as the Google/365/Onelogin account.
• All email addresses must belong to the domain which we have configured to correspond to the credentials.  (e.g. "@yourdistrict.edu" will be mapped to your district's SSO credentials.)

 

Notes specific to Microsoft 365/Entra setup:

• Properties > User Access URL is what will be used to login
• Certificate (Base64) is what needs to be installed in Siras
• Leave "Sign On URL" blank (only specify Entity ID and Reply URL)
• Ensure "emailaddress" = "user.mail" is part of Attributes & Claims (should be the default)
• User may need to be assigned to the app in Entra