ARTICLE: How to configure Single-Sign-On with SAML within your Reach Portal
You can configure Single Sign On using SAML directly within your REACH portal at System Configuration > Authentication
Single Sign In will appear on the login screen for REACH with access to use the your school's Single Sign In authentication to access REACH.
How to Configure SAML in REACH
1. Create a SAML application in your IdP to represent REACH.
- This will need an "Entity Identifier", which for REACH will be https://<REACH Portal address>
- This will also need an "Assertion Consumption Service URL" or "ACS URL", which for REACH will be https://<REACH Portal address>/samlACS
2. As part of, or at the end of this creation process, the IdP will typically expose some information for copying or downloading, which you will need to put into the Authentication page in REACH (System Configuration > Authentication)
Public signing certificate - enter this the Identity Provider Public Key(s) field- SSO URL - enter this into the Identity Provider Login URL field
Suggested Support resources for various systems
You can access some official support guides for varioius systems at the links below:
- for Google GSuite go to
https://support.google.com/a/answer/6087519?hl=en - Changes to Google OAuth require schools to allow permission for 3rd party apps to have access to data for minors. Schools must configure this for students to be able to log into Reach using Google OAuth: https://support.google.com/a/answer/7281227?hl=en
- for AD FS you can go to
https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust - for Azure aD you can go to
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-setup-sso