Single sign-on (SSO) lets learners sign in to Go1 with the same identity provider they already use at work. This helps your organization manage access centrally and gives learners one less password to remember.
This guide explains the common setup steps for SAML SSO. For provider-specific steps, use the guide for your identity provider:
If your organization uses Microsoft Entra (aka. Azure AD), you may also be able to use Go1's native Microsoft Entra connection instead of SAML. The native connection is usually simpler to set up. See: Single Sign On with Microsoft Entra (Azure AD).
Before you start
You will need:
Admin access to your Go1 portal.
Admin access to your identity provider.
A test learner account that is assigned to the SAML application.
The login URL for your Go1 portal.
Time to test the connection before you roll it out to all learners.
If your portal already uses SSO, avoid changing the live configuration until you have confirmed the setup with your Go1 contact.
How SAML SSO setup works
Most SAML SSO setups follow the same pattern:
Create a SAML application in your identity provider.
Add Go1's service provider details to the SAML application.
Add the learner attributes Go1 needs, such as email, first name, and last name.
Optional: add the learner's locale so Go1 can set their platform language when they sign in.
Copy the identity provider metadata into Go1.
Enable and test the SSO connection in Go1.
Roll out the connection to your learners.
Your identity provider may use slightly different labels for the same SAML settings.
Refer the IDP specific guides for more information.
Configure Go1 connection for your Identity Provider
Your SSO team will need to set up part of the SSO connection on your SSO platform (Identity Provider) prior to completing the steps below in your Go1 platform.
Go1 service provider details
Add these Go1 values to your SAML application.
Setting | Value |
ACS URL, Reply URL, or Single sign-on URL | |
Entity ID, Audience URI, or SP Entity ID | urn:amazon:cognito:sp:ap-southeast-2_oZpTmvPtK |
Sign-on URL | Your Go1 portal login URL |
Logout URL | Your Go1 portal logout URL |
Some identity providers also support IdP-initiated sign-in. If you want learners to start from your identity provider dashboard, add this RelayState value - which can be downloaded from the UI:
identity_provider=saml-{customer portal id}&client_id=33hckk53i9d9hn55djs3j1hk5&scope=openid&response_type=code&redirect_uri=https://api.go1.co/sso/saml/cognito-callback/ap-southeast-2_oZpTmvPtKReplace {customer portal id} with your Go1 portal ID. This string can be retrieved from the Go1 SSO page where you can download the environment specific SAML metadata, which contains the default RelayState at the end.
Learner attributes Go1 expects
Your SAML application needs to send learner attributes to Go1. These attributes help Go1 match or create the learner account during sign-in.
Learner detail | SAML claim | Required? |
True | ||
First name | True | |
Last name | True | |
Locale | False |
Use the learner's supported Go1 platform language value. If your identity provider stores regional values such as fr-FR or en-AU, confirm the expected format with your Go1 contact before rollout.
Map SAML claims in Go1
In Go1, map each Go1 field to the SAML claim sent by your identity provider:
{ "email": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "family_name": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", "given_name": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", "locale": "https://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality" }Claims can differ pending on the IDP you use - please refer to the setup guide for you IDP for specific claim details.
Mapping other profile fields
The SAML locale mapping above is a core Go1 account field and does not require Go1 to create an additional field for customers to utilise.
Other learner profile fields, such as job title or industry, can help Go1 personalize the learner experience. These fields may need Go1 to configure additional fields and update the SAML mapping before they can be used with SSO.
Contact your Go1 Implementation or Support team before adding extra fields to SAML. If a field is mapped but your identity provider does not send it for a learner, sign-in may fail for that learner.
If your main goal is to keep learner profile data in sync over time, SCIM provisioning may be a better fit than SAML SSO.
Enable SSO in Go1
Log in to an administrator account on your Go1 Platform.
Navigate to MyGo1
Access the Integrations page by clicking your initials in the top-right navigation, followed by Integrations.
Select from the left-hand menu the tab: Single Sign-On.
From the Single sign-on settings, check the box: Enable Single sign-on
Configure SSO in Go1
After you set up the SAML application in your identity provider, copy the identity provider details into Go1.
You will need:
Identity provider sign-in URL.
Identity provider entity ID.
X.509 signing certificate.
Optional: identity provider logout URL.
The field mapping JSON.
Enable the SSO connection only when the required values are complete.
(Optional) Customise your SSO sign-up button
Administrators can also customise the button text that displays on your Go1 Platform's sign-in page, which by default says "Login with Identity Provider". This will only be visible if you have multiple SSO connections or have the option to login with username/password on.
Type the text into the field provided to see a preview and then click Save to apply that change.
Note: In some instances, custom configuration may be required on Go1’s authorisation platform Cognito. Please speak to your Implementation Project Manager or Go1 Support before making changes to an existing SSO setup.
(Optional) Configure Login/Registration Options
Once your connection is successfully configured and tested you may also choose to enable/disable two additional settings that can be found under the Go1 platform Settings page.
To find these go to your avatar in the top right-hand corner > choose Settings > choose Configuration from the left-hand menu > under Enabled Applications you will see the following:
Hide login with email option
This makes SSO the only option to access your Go1 platform and auto-redirects users to SSO login.
Disallow Register via SSO
Go1 enables just-in-time provisioning by default on all SSO connections, this can be disabled here.
Test the connection
Before rollout:
Assign your test learner to the SAML application in your identity provider.
Sign in to Go1 as that learner.
Check that the learner account is matched or created correctly.
Check that first name, last name, and email look correct in Go1.
If you mapped locale, check that the learner's platform language is set as expected.
Test with at least one learner who has every mapped attribute populated in your identity provider.
If sign-in fails, check that the identity provider is sending every attribute you mapped in Go1.
Roll out SSO
When testing is complete:
Assign the SAML application to the learners or groups who should use Go1.
Share the correct Go1 login link with your learners.
If learners use learn.go1.com and are asked to choose a portal before SSO, share a portal-specific link such as https://learn.go1.com?portal=yourportal.mygo1.com.
If you use IdP-initiated sign-in, confirm the RelayState is configured and enable IdP-initiated SSO in Go1.
If you want all learners to use SSO, ask your Go1 contact about the best way to guide learners to the SSO flow.