Skip to main content

Installing ClassLink SSO

Installing ClassLink SSO

The Classlink SSO App allows administrators to integrate Incident IQ with a local AD server. This will enable districts to automatically populate and update user data in iiQ directly from their AD server.

Prerequisites

Before beginning the installation process, you will need the following:

  • An active directory vendor account that has the following permissions:

    • Replicating directory changes.

    • Read.

  • A machine that runs .NET Framework v.4.5.1 or higher and has network access to your district’s AD server.

Important Note: You must complete this step before proceeding. If you are unfamiliar with granting these specific permissions to a user, please refer to the following Microsoft help guide on Giving Users Replicating Directory Changes Permissions.

Installing the App

Once you have the prerequisites, select Incident IQ Apps > Browse on the left navigation bar. Click the desired SSO app located in the Single Sign On section, then select Install to begin.

Once the installation is complete, click Manage App Settings, then continue to the next section to configure your SSO installation.

Connector File Configuration

1. Initial Setup

  • Navigate to the Overview Tab.

  • Select the following two options:

    • Enable User Login

    • Enable User Sync

  • Click Save.

2. Connector Configuration

  • Click Sync Executable from the app tabs list.

  • Input the following required connection information:

    • AD Username: (Use the service account created in [section 1] of this document).

    • AD Password

    • AD Domain: (e.g., district.k12.tx.us).

    • AD Server IP: (e.g., 12.3.4.56).

3. Optional Configurations

You may configure these settings at any time:

  • OU Exclusions: Configure filters to prevent account information from specific AD OUs from being included in system syncs.

  • Additional AD Attributes: Enable synchronization for data points such as Student/Employee ID and Grade if they exist in AD.

4. Download and Deployment

  • Click Download Executable to retrieve the connector app.

  • Deployment Note: Download this file to a device that has access to your AD server and runs overnight.

5. Manual Sync and Validation

  • Locate and execute the IncidentIQ.Connectors.MicrosoftAd application (ignore the .CONFIG and .PDB files).

  • In the connector app window that appears, click Run now.

  • Result: A successful execution sends a user data packet to Incident IQ, which can then be used to run a system sync.


Establishing the IDP/ISP Connection with Classlink

This documentation is for ClassLink Administrators using the ClassLink Management Console (CMC) to configure the institution’s LaunchPad experience.

  1. Retrieve Incident IQ Metadata URL

  • Navigate to the ClassLink SSO app.

  • Click the Download Service Provider Metadata button.

  • Copy the URL from the address bar of the new tab that opens.

2. Retrieve ClassLink SAML URL

  • Once the connection is established, copy the required URL directly from the ClassLink SAML console.

3. Configure Incident IQ Identity Provider Settings

  • Navigate to the Classlink SSO app within Incident IQ.

  • Open the Identity Provider Settings tab.

  • Paste the URL copied from the ClassLink SAML console into the URL field.

4. Map SAML Attributes

  • In the Identity Provider Settings tab, map the SAML attributes required for login.

  • Examples: login_id, username, email, sAMAccountName, etc.

5. Complete Role and Location Mappings

  • Configure the Role mappings and Location mappings.

  • Map users to locations and roles within iiQ using OUs, groups, or any other attribute that captures each user's location or role.

Scheduling Nightly SFTP Server Data Syncs

To automate uploads, create a task in the Windows Task Scheduler. You can find this tool by searching for ‘Administrative Tools’ and selecting ‘Task Scheduler’.

  1. Create Task: Click Action > Create Basic Task…


    ​

  2. Name Task: Follow the Create Basic Task Wizard to name your task. Click Next.

  3. Set Trigger: Select Daily (overnight) to ensure data accuracy.

    1. Configure the task to run regardless of whether the user is logged in. Click Next.

  4. Define Action: Select Start a Program. Click Next.
    ​

  5. Configure Program:

    1. Locate the .exe file of your FTP program.

    2. Enter the required command-line parameters specific to your software documentation. Click Next.


6. Finalize & Properties:

a. Check the ‘Open the Properties dialog for this task when I click Finish’ box.

b. Click Finish.

7. Adjust Security: In the Properties window, ensure the following are checked:

a. Run whether the user is logged on or not

b. Run with the highest privileges

c. Click OK.

Mapping User Roles and Locations

Configure the default Role and Location settings immediately as fallbacks if a user account does not match any custom mappings. You can find these configurations in the Role Mappings and Location Mappings tabs.

We recommend the following:

  • Default Role: Set to Guest during initial setup. Once your custom mappings are complete and user roles are verified, update this to No Access.

  • Default Location: Use the Central/District Office location or create a specific location (such as Unassigned) for this.

Related Articles
Did this answer your question?