Table of Contents

SSO / SAML 2.0 Integration

Overview

LEAST acts as a SAML 2.0 Service Provider (SP). Your Identity Provider (IdP) authenticates users and sends a signed assertion to LEAST. LEAST provisions or matches the user account and starts a session.

For admin-facing configuration (entering IdP settings in the UI), see SSO Configuration.

Endpoints

Endpoint URL Method Purpose
SP Metadata /sso/metadata.php GET Machine-readable SP metadata (XML) — give this to your IdP
Login Initiator /sso/login.php GET Redirects the user to the IdP's SSO URL
ACS (Assertion Consumer Service) /sso/acs.php POST Receives the SAML Response from the IdP

SAML Flow

  1. User navigates to https://wherewelearn.com/sso/login.php
  2. LEAST builds a SAMLRequest (AuthnRequest), signs it, and redirects the user's browser to the IdP
  3. User authenticates at the IdP
  4. IdP redirects the user's browser to the ACS URL (sso/acs.php) with a SAMLResponse
  5. LEAST verifies the signature using the IdP's stored certificate
  6. LEAST matches or provisions the user account
  7. User is silently logged in and redirected to the platform

SP Metadata

Retrieve the SP metadata for your IdP registration: 

GET https://wherewelearn.com/sso/metadata.php

Returns an XML document containing:

NameID Format

LEAST expects the NameID to be the user's email address. Configure your IdP to send: 

<NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" AllowCreate="true"/>

Attribute Requirements

LEAST reads from the SAML assertion:

Attribute Required Notes
Email (or NameID) Yes Used for account matching / provisioning
givenName No First name — used for JIT account creation
sn or surname No Last name — used for JIT account creation

Signature Verification

LEAST verifies the SAML Response signature using the IdP certificate stored in the admin SSO config. Unsigned or incorrectly signed assertions are rejected.

Testing

  1. Use a SAML testing tool (e.g. SAML Tracer browser extension) to inspect the assertion
  2. Check that NameID contains the user's email address
  3. Verify the assertion signature validates against the configured certificate
  4. On success, the user should be silently provisioned and logged into LEAST

Troubleshooting

Symptom Likely cause
“Issuer not found” Entity ID in the assertion does not match the stored IdP Entity ID
“Signature invalid” Certificate mismatch — re-download and re-enter the IdP certificate
“NameID missing” IdP not sending email in the NameID — check IdP attribute release policy
Redirect loop ACS URL is returning a new AuthnRequest — check session cookie settings