Single sign-on (SSO) lets learners sign in to Go1 with the same identity provider they already use at work. This helps your organization manage access centrally and gives learners one less password to remember.
This guide explains the common setup steps for SAML SSO. For provider-specific steps, use the guide for your identity provider:
If your organization uses Microsoft Entra (aka. Azure AD), you may also be able to use Go1's native Microsoft Entra connection instead of SAML. The native connection is usually simpler to set up. See: Single Sign On with Microsoft Entra (Azure AD).
Before you start
You will need:
Admin access to your Go1 portal.
Admin access to your identity provider.
A test learner account that is assigned to the SAML application.
The login URL for your Go1 portal.
Time to test the connection before you roll it out to all learners.
If your portal already uses SSO, avoid changing the live configuration until you have confirmed the setup with your Go1 contact.
How SAML SSO setup works
Most SAML SSO setups follow the same pattern:
Create a SAML application in your identity provider.
Add Go1's service provider details to the SAML application.
Add the learner attributes Go1 needs, such as email, first name, and last name.
Optional: add the learner's locale so Go1 can set their platform language when they sign in.
Copy the identity provider metadata into Go1.
Enable and test the SSO connection in Go1.
Roll out the connection to your learners.
Your identity provider may use slightly different labels for the same SAML settings.
Refer the IDP specific guides for more information.
Configure Go1 connection for your Identity Provider
Your SSO team will need to set up part of the SSO connection on your SSO platform (Identity Provider) prior to completing the steps below in your Go1 platform.
Go1 service provider details
Add these Go1 values to your SAML application.
Setting | Value |
ACS URL, Reply URL, or Single sign-on URL | |
Entity ID, Audience URI, or SP Entity ID | urn:amazon:cognito:sp:ap-southeast-2_oZpTmvPtK |
Sign-on URL | Your Go1 portal login URL |
Logout URL | Your Go1 portal logout URL |
Some identity providers also support IdP-initiated sign-in. If you want learners to start from your identity provider dashboard, add this RelayState value - which can be downloaded from the UI:
identity_provider=saml-{customer portal id}&client_id=33hckk53i9d9hn55djs3j1hk5&scope=openid&response_type=code&redirect_uri=https://api.go1.co/sso/saml/cognito-callback/ap-southeast-2_oZpTmvPtKReplace {customer portal id} with your Go1 portal ID. This string can be retrieved from the Go1 SSO page where you can download the environment specific SAML metadata, which contains the default RelayState at the end.
Learner attributes Go1 expects
Your SAML application needs to send learner attributes to Go1. These attributes help Go1 match or create the learner account during sign-in.
Learner detail | SAML claim | Required? |
True | ||
Given name | True | |
Family name | True | |
Locale | False | |
Job Title | False | |
Job Level | False | |
Division | False | |
Country | False | |
Industry | False | |
State | False | |
City | False | |
Phone | False | |
Gender | False | |
Start Date | False |
Use the learner's supported Go1 platform language value. If your identity provider stores regional values such as fr-FR or en-AU, confirm the expected format with your Go1 contact before rollout.
Map SAML claims in Go1
In Go1, map each Go1 field to the SAML claim sent by your identity provider:
{
"email": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
"family_name": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
"given_name": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
"locale": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality",
"custom:job_title": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/job_title",
"custom:job_level": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/job_level",
"custom:division": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/division",
"custom:country": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/country",
"custom:industry": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/industry",
"custom:state": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/state",
"custom:city": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/city",
"custom:phone": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/phone",
"custom:gender": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/gender",
"custom:start_date": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/start_date"
}Claims can differ pending on the IDP you use - please refer to the setup guide for you IDP for specific claim details.
Mapping other profile fields
The SAML locale mapping above is a core Go1 account field and does not require Go1 to create an additional field for customers to utilise.
Other learner profile fields, such as job title or industry, can help Go1 personalize the learner experience. These fields may need Go1 to configure additional fields and update the SAML mapping before they can be used with SSO.
Contact your Go1 Implementation or Support team before adding extra fields to SAML. If a field is mapped but your identity provider does not send it for a learner, sign-in may fail for that learner.
If your main goal is to keep learner profile data in sync over time, SCIM provisioning may be a better fit than SAML SSO.
Enable SSO in Go1
Log in to an administrator account on your Go1 Platform.
Navigate to Learn
Access the Integrations and apps page by clicking on the
...next to your profile, and then clicking SettingsSelect your preferred single-sign on method, and click Connect
Configure SSO in Go1
After you set up the SAML application in your identity provider, enter your App credentials into the configuration form:
You will need:
Identity provider sign-in URL.
Identity provider entity ID.
X.509 signing certificate.
Optional: identity provider logout URL.
The field mapping JSON.
After configuring your App credentials, you can now configure your Login and logout links, and optionally the login button text.
Once fully configured - review your completed configuration - and click Enable SSO to enable single sign-on.
Your configured Single Sign-on connection will now show as Connected
Test the connection
Before rolling our single sign-on to your organisation, it is recommended you test the connection. We recommend this process:
Assign your test learner to the SAML application in your identity provider.
Sign in to Go1 as that learner.
Check that the learner account is matched or created correctly.
Check that first name, last name, and email look correct in Go1.
If you mapped locale, check that the learner's platform language is set as expected.
Test with at least one learner who has every mapped attribute populated in your identity provider.
(Optional) If migrating from Auth0, you can now deactivate your previous Auth0 connection
If sign-in fails, check that the identity provider is sending every attribute you mapped in Go1.
Roll out SSO
When testing is complete:
Assign the SAML application to the learners or groups who should use Go1.
Share the correct Go1 login link with your learners.
If learners use learn.go1.com and are asked to choose a portal before SSO, share a portal-specific link such as https://learn.go1.com?portal=yourportal.mygo1.com.
If you use IdP-initiated sign-in, confirm the RelayState is configured and enable IdP-initiated SSO in Go1.
If you want all learners to use SSO, ask your Go1 contact about the best way to guide learners to the SSO flow.
Disabling Single Sign-On
If you wish to disable Single Sign-On at any time, follow these steps.
Access the Integrations and apps page by clicking on the
...next to your profile, and then clicking SettingsSelect your preferred single-sign on method, and click Manage
Toggle Sign sign-on off
