Use federated authentication with your identity provider in Apple School Manager
In Apple School Manager, you can link to your identity provider (IdP) using federated authentication to allow users to sign in to Apple devices with their IdP user name (generally their email address) and password.
As a result, your users can leverage their IdP credentials as Managed Apple IDs. They can then use those credentials to sign in to their assigned iPhone, iPad or Mac, and even to iCloud on the web.
Before you begin
Before you link to your IdP, consider the following:
Federated authentication should use the user’s email address as their user name. Aliases are not supported.
For existing users with an email address in the federated domain, their Managed Apple ID is automatically changed to match that email address.
Configure and verify the domain you want to use. See Link to new domains.
Disconnect from your Student Information System (SIS) or stop uploads using SFTP.
User accounts with the role of Administrator, Site Manager or People Manager cannot sign in using federated authentication; they can only manage the federation process.
When the IdP connection has expired, federation and syncing user accounts with your IdP stops. You must reconnect to your IdP to continue using federation and syncing.
For federated authentication, have the following information:
Sign-in method: Use Open ID Connect (OIDC).
Scope access: Access must be granted to
ssf.manageandssf.read.Shared Signals Framework (SSF) configuration URL: Consult your IdP’s documentation.
OpenID configuration URL: Consult your IdP’s documentation.
Federated authentication process
This process involves four main steps:
Add and verify a domain.
Create a new OIDC app or connection.
Configure federated authentication and test authentication with a single IdP user account.
Turn on federated authentication.
Step 1: Verify a domain
Before you can view your IdP user accounts with Apple School Manager, you must add and verify the domain you want to use.
See Link to new domains.
The verification process ensures that your organisation is the one that has authority to modify the domain name service (DNS) records for your domain. For example, to use betterbag.com as your domain, you add a specific TXT record to your domain name server’s zone file within 14 calendar days of beginning the verification process (which begins when you select the Verify button).
Note: If you are attempting to federate a domain you have already verified but another organisation has already federated the identical domain, you must contact that organisation to determine who has the authority to federate the domain. See About domain conflicts.
Step 2: Create a new OIDC app or connection
To connect to Apple School Manager, your IdP must have or create an app, that contains specific settings to link to Apple School Manager. Because each IdP has a different method for creating an app and a place where specific settings are located, consult your IdP’s documentation on how to complete this process.
Sign in to your IdP as an administrator, then do one of the following:
Locate the app created by your IdP. You may be able to skip several steps in this task.
Navigate to where you can create an app or connection.
Create the app or connection with the following information:
Apple School Manager: AppleSchoolManagerOIDC.
Sign-in method: Open ID Connect (OIDC).
App type: Web app.
Grant type: Refresh token.
Sign-in redirects URI: https://gsa-ws.apple.com/grandslam/GsService2/acs.
Access: Allow specific user accounts.
Scope access: Access must be granted to
ssf.manageandssf.read.
Save the changes.
Later on this page, you must paste certain information in Apple School Manager. This next task is to copy that information to a text or spreadsheet file.
Open a new text file or spreadsheet, then enter the following values from the IdP:
For the OIDC client ID, paste the OIDC client ID.
For the OIDC client secret, paste the OIDC client secret.
Save the file to a secure location.
Step 3: Configure federated authentication and test authentication with a single IdP user account
This task allows your IdP to trust Apple School Manager.
Note: After you complete this task, users cannot create new personal Apple IDs on the domain you configure. This could affect other Apple services you use. See Transfer Apple services when federating.
In Apple School Manager
, sign in with a user that has the role of Administrator, Site Manager or People Manager.Select your name at the bottom of the sidebar, select Preferences
, select Managed Apple IDs
, then select Get Started under “User sign in and directory sync”.Select Custom Identity Provider, then select Continue.
Enter a name for your federated authentication connection.
You can use up to 128 characters.
Copy the client ID and client secret values into Apple School Manager from the text file or spreadsheet you saved in the previous section.
Contact your IdP to get URLs for the following two configurations:
Shared Signals Framework (SSF)
OpenID
Select Continue.
If all the values you provided were valid, you are presented with the sign-in page of your IdP. Proceed to step 8.
Sign in with an IdP administrator user name and password.
Select Done.
Step 4: Turn on federated authentication
In Apple School Manager
, sign in with a user that has the role of Administrator, Site Manager or People Manager.Select your name at the bottom of the sidebar, select Preferences
, then select Managed Apple IDs .In the Domains section, select Manage next to the domain you want to federate, then select “Turn on Sign in with your Identity Provider”.
Turn on “Sign in with your Identity Provider”.
If necessary, you can now sync user accounts to Apple School Manager. See Sync user accounts from your identity provider.