Give people a familiar route into Honen with the identity system your organization already uses. Choose the sign-in flow, decide how new learners join, and test the experience before rollout.
Choose a sign-in path
| Your starting point | Honen setup | Guide |
|---|---|---|
| Google Workspace, Microsoft Entra ID, Okta, Auth0, Keycloak, or another OIDC provider | OpenID Connect | Connect an identity provider |
| Your own authenticated application or customer portal | A short-lived assertion signed by your backend | Launch with Signed JWT |
| A learner launches training from an LMS | The LMS integration establishes the learning launch and identity | LTI 1.3, SCORM, Google Classroom, or cmi5 |
Open Organization → Integrations → Identity & SSO in the intended team workspace. Administrators need Manage integrations permission to configure the connection. Agree the provider-side application and rollout audience with your identity administrator.
Plan for a SAML-based identity environment
Many organizations use one identity provider for both SAML and OpenID Connect applications. For Honen, have your identity administrator configure an OIDC confidential web application in that provider and use the Honen callback URL. The OIDC guide includes the provider choices and exact connection fields.
If your organization's requirements specify SAML assertions or SAML-only application registration, agree the integration approach with the Honen team before rollout. Share the provider, intended audience, provisioning needs, and required application protocol so the setup can be planned precisely.
Choose how people join
- JIT provisioning on: a new email can create a real Honen account and join the configured workspace during sign-in.
- JIT provisioning off: arrange the person's Honen account and workspace membership before the first sign-in.
- Default member role: choose Member for learners or Instructor for people who need the instructor role. Review your workspace's role permissions separately.
For planned cohorts, create the group, add the right members, and prepare assignments. Identity, group membership, and assignment requirements are distinct parts of the rollout.
Understand first-time account linking
For a person who already has a Honen account with the same email, the first SSO launch can ask them to sign in to that exact account and confirm the identity connection. Returning sign-ins use the established provider identity.
Ask a test user to finish the complete linking flow, return to the intended workspace, and open an assigned course. This checks the experience a real learner will encounter.
Choose the session scope
The usual SSO session is scoped to the connected workspace. This gives learners a focused entry point for that organization's learning.
Use Allow account-wide session requests only when your rollout needs a broader account experience. An account-wide session requires the client to request it, the workspace setting to allow it, and the user to approve that identity. Keep the ordinary workspace scope for a dedicated workforce or customer-learning launch.
Manage the connection over time
Assign an owner for provider configuration, credentials, and test accounts. Keep a record of the issuer, intended workspace, application owner, role choice, and first successful learner test. Rotate credentials using the connection's controls and retest the launch.
Use the connection's enabled state to control new sign-ins. When retiring a connection, plan account access and session revocation as part of the change: disabling new sign-ins and ending existing sessions are separate actions.
Continue with OIDC setup, Signed JWT setup, and Access and roles.