SAML is an authentication standard used by many systems, including Blackboard Learn, to authenticate a sign on request. In the case of UAS, you are creating an identity provider-initiated SAML response. You must configure a Blackboard Learn authentication adapter to accept the response from UAS. Course and URL forwarding in Blackboard Learn are handled through the standard SAML RelayState parameter.
The SAML authentication type can only be used for the outgoing authentication response, and you can only have one active SAML configuration.
Configure UAS Settings
- Navigate to the UAS Settings screen.
- Select Add Authentication Adapter.
| Alias | This is a unique name for the adapter and is used in URLs. The alias will be stored as all lowercase letters and should not contain any special URL characters. |
|---|---|
| Enabled | This toggle determines whether the adapter is available for use. |
| Auth Type | SAML |
| Private Key | The x509 private key. The value will only be visible while creating the adapter. (See Generate Public and Private Keys) |
| Public Key | The x509 public key. This key will be shared with the SAML service provider via the generated data. (See Generate Public and Private Keys) |
| Audience | The audience for this SAML response. The recommended value is your Blackboard Learn system base URL. |
| Destination URL | When initially creating the adapter, this URL can be anything. You will need to provide the ACS URL from the Blackboard Learn authentication provider (step 3) after the initial configuration. |
| Issuer | This is how you want to identify the UAS service. Any value can be used. A suggested value is UAS_SAML. |
| Logout POST URL | The URL which handles a POST method when the user logs out of Learn. This is optional. When a URL is entered here, users are redirected to this site upon logging out of Learn. (In most cases, you only need to specify a redirect or a POST URL, not both.) |
| Logout Redirect URL | The URL a user is redirected to when logging out of Learn. This is optional. When a URL is entered here, users are redirected to this site upon logging out of Learn. (In most cases, you only need to specify a redirect or a POST URL, not both.) |
| Default | This toggle determines whether this is the SAML configuration that will be used. You can only have one Default enabled. Enabling this toggle will disable all other SAML configurations. |
- Select Save to save your configuration.
Configure the Blackboard Learn authentication adapter
Before you begin, you need to copy your Site ID. To do so, access the Admin Panel in Blackboard Learn. Select the Cloud Connector link under Cloud Management. Copy the Site ID to use later in this process.
Add the Adapter
Access the Admin Panel. Select the Authentication link under Integrations. Select Create Provider to create a new provider and select SAML.
- Provide a descriptive Name.
- Set to Active.
- Select either Username or Batch Uid, depending on the value that your system will be providing for the user ID.
- Select Restrict this provider to only the specified hostname to prevent the link from showing on the login page. You cannot launch the authentication flow from the login page and have it authenticate successfully.
- Enter localhost for Restricted Hostnames.
- Enter the link text. This text is not displayed anywhere but is still required.
- Select Save and Configure to move on to the SAML configuration.
Configure the adapter
- Ensure the ACS URL has the option with your site selected.
- Specify a value for the Entity ID. We recommend that you make this value your site URL.
- Select enable IdP-initiated SSO. Once selected, this will change your ACS URL. Copy the ACS URL value and update the SAML Adapter Destination URL in the UAS configuration with this URL.
- Leave the Single Logout Service Type set to the default.
- Leave the Data Source drop-down menu set to the default.
- Select the appropriate Compatible Data Sources which should be allowed to use this authentication provider.
- Do not select Enable JIT Provisioning.
- Optionally, enter a custom error message that will appear when a user is unable to authenticate with SAML single sign-on.
- Select Metadata URL for the Metadata Type.
- The URL will be https://us.extensions.blackboard.com/api/v2/authadapters/sites/{siteId}/metadata where {siteID} can be found in the Cloud Connection Settings (copied at the beginning of this procedure).
- Select the Verify button, and you should see a green checkmark. If there is an error in your UAS configuration, verify that you have a default SAML adapter enabled with created public and private keys and verify your URL is correct. Make sure you have updated the Destination URL as indicated in step three. You can test the URL in a new browser; it should return an XML document of your metadata.
- Set the remote user ID to NameID.
- Select Submit to save your configuration.
