Single Sign-On (SSO) Setup

Who this guide is for: Organization Owners (or members holding a custom role that grants the SSO page) who want to allow their organization’s users to sign in to EmbayLMS using their corporate identity provider (e.g., Okta, Microsoft Entra ID, Google Workspace, Ping, ADFS).

EmbayLMS supports four SSO provider types. Choose the one that matches your identity provider:

SAML 2.0 Setup

Overview

embaylms supports SAML 2.0 SP-initiated single sign-on. Once configured:

• Users click Sign in with SSO on the embaylms login page and are redirected to your identity provider (IdP).
• After authenticating with the IdP, they are returned to embaylms and signed in automatically.
• Just-in-time (JIT) provisioning (enabled by default) creates a user account on first login — no manual account creation required.

Prerequisites

• The Owner role, or a custom role that grants Settings → SSO / Identity
• Access to your identity provider’s admin console
• Your IdP must support SAML 2.0 (SP-initiated flow)

Step 1 — Get the SP (embaylms) values for your IdP

embaylms acts as the Service Provider (SP). Your IdP needs to know where to send SAML assertions. Retrieve the SP values from embaylms before configuring your IdP.

In embaylms: Navigate to Settings → User Management → SSO / Identity.

Click View SP Metadata to download the XML, or note these values manually:

Tip: Most modern IdPs (Okta, Entra ID) support importing SP metadata by URL. Use the SP Metadata URL above to auto-fill all SP values in your IdP.

Step 2 — Configure your IdP

Register embaylms as a SAML application in your IdP using the SP values from Step 1. See the IdP-specific guides:

• Okta SAML setup →
• Microsoft Entra ID SAML setup →
• All identity-provider guides →

Your IdP will provide the following values once the application is created — you will need them in Step 3:

Step 3 — Enter IdP values in embaylms

1. In embaylms, navigate to Settings → User Management → SSO / Identity.
2. Click Add Identity Provider.
3. Select SAML 2.0 as the provider type.
4. Fill in the following fields:

5. Click Save.

EmbayLMS reads the certificate’s expiry date when you save. A certificate that has already expired is refused with “This certificate expired on {date}” — saving it would make every SSO sign-in fail. See Step 6 for how expiry is tracked.

Step 4 — Configure JIT provisioning (optional)

Just-in-time (JIT) provisioning automatically creates a user account in embaylms the first time someone signs in via SSO — no pre-creating accounts needed.

To configure: In the IdP settings panel, expand JIT Provisioning.

Recommended roles:

• learner — Standard learner access (appropriate for most organizations)
• instructor — Can create and manage courses
• manager — Can view team reports and manage team enrollments
• admin — Full admin access (only use this if all SSO users should be admins)

To disable JIT (users must be manually created before their first SSO login): Toggle JIT provisioning to OFF. Users who try to sign in before being provisioned will see an “account not found” error.

Step 5 — Test the integration

1. Open a private / incognito browser window (important — avoids cached sessions).
2. Navigate to your embaylms login page: https://{your-tenant}.embaylms.com/login
3. Click Sign in with SSO.
4. You should be redirected to your IdP’s login page.
5. Authenticate with a test user account.
6. You should be redirected back to the embaylms dashboard.

If using JIT provisioning, the user account is automatically created on this first login.

Step 6 — Keep the signing certificate current

Your identity provider signs every SAML sign-in with its signing certificate, and that certificate has an expiry date. IdPs renew it on their own schedule (Entra ID and Okta default to 1–3 years). The day it expires, every SSO sign-in fails until the renewed certificate is pasted into EmbayLMS. In SSO-only mode that means nobody except the break-glass account can sign in.

EmbayLMS tracks the date for you:

1. On the SSO page. Each SAML provider shows Signing certificate valid until {date}. From 60 days before the date, a badge counts down the days — amber until the last week, red in the last 7 days and once expired — with a line saying what to do. With SSO-only mode on, the line also warns that only the break-glass account will still be able to sign in.
2. By notification. Every active Owner and Admin receives an in-app notification and an email 60, 30 and 7 days before the expiry, in their own language. Each warning is sent once per certificate. You can turn either channel off under My profile → Notifications → SSO certificate expiring (admins), and reword the email under Templates → Email.
3. Embay support sees it too. Certificates expiring within 60 days appear on the Embay platform console, with SSO-only tenants flagged as a lockout risk.

To renew:

1. In your IdP, create or activate the new signing certificate (Entra ID: Enterprise applications → your app → Single sign-on → SAML Certificates; Okta: Applications → your app → Sign On → SAML Signing Certificates).
2. Copy the new certificate (PEM, or the base64 value from the metadata file).
3. In EmbayLMS, open Settings → Single Sign-On, click Edit on the SAML provider, paste the new certificate into X.509 Certificate (PEM) and click Save configuration.
4. Test a sign-in from a private browser window. The row now shows the new valid until date, and the 60 / 30 / 7-day warnings start over for it.

Timing: most IdPs keep signing with the old certificate until you activate the new one. Paste the new certificate into EmbayLMS at the same time you activate it in the IdP — before that, sign-ins are still signed with the old one.

Configuration Reference

Troubleshooting

Sign-in error messages

Each message below points at one specific field. The message shown on the login page tells you which.

Saving the configuration

“Your identity provider did not provide an email address” The SAML assertion does not include an email attribute. Ensure your IdP is configured to send the user’s email. See the attribute mapping table in the relevant IdP guide.

“Your account was not found” JIT provisioning is disabled for this IdP connection and the user does not have a pre-created account. Either:

• Enable JIT provisioning in Settings → User Management → SSO / Identity → Edit, or
• Create the user account manually in Users before they attempt SSO.

“Your account has been deactivated” The user exists in embaylms but their account is deactivated. Re-activate it in Users → [user] → Activate.

OIDC Setup (Google Workspace, Microsoft Entra ID, Generic OIDC)

OIDC providers use a discovery URL and OAuth 2.0 client credentials instead of SAML certificates.

Step 1 — Create an OAuth application in your identity provider

Set the redirect URI in your IdP to:

https://{your-tenant}.embaylms.com/api/auth/oidc/{slug}/callback

Your IdP will provide a Client ID, Client Secret, and a Discovery URL (the .well-known/openid-configuration endpoint).

Step 2 — Enter values in EmbayLMS

1. Navigate to Settings → User Management → SSO / Identity.
2. Click Add Identity Provider.
3. Select your provider type (Google Workspace, Microsoft Entra ID, or OIDC).
4. Fill in:

5. Configure JIT provisioning and click Save.

OIDC Discovery URLs by provider

Managing multiple identity providers

EmbayLMS supports more than one active IdP per tenant. This is useful if you have:

• A SAML integration for most employees and a Google OIDC connection for contractors.
• A legacy SAML integration being migrated to OIDC.

All enabled IdP configurations are offered at login. Users will be redirected to whichever provider they select (or the only one if just one is enabled).

To disable an IdP without deleting it: use the toggle in Settings → User Management → SSO / Identity. This preserves the configuration for future use.

Related guides

• Okta SAML setup
• Microsoft Entra ID SAML setup
• Google Workspace OIDC setup
• SCIM provisioning
• Learner guide: Sign in with SSO
• User management