TracCloud: Single Sign-On - Revision history

Redrock at 19:09, 20 April 2026

2026-04-20T19:09:39Z

← Older revision		Revision as of 19:09, 20 April 2026
Line 12:		Line 12:
	====SAML====		====SAML====
	::To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.		::To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.

			::<span style="color:red">Relay State URL should be left blank.</span>

	::<b>1. Install our Metadata</b>		::<b>1. Install our Metadata</b>

Redrock at 16:43, 10 April 2026

2026-04-10T16:43:03Z

← Older revision		Revision as of 16:43, 10 April 2026
Line 6:		Line 6:
	<div class="pageTitle">TracCloud Single Sign-on Configuration</div>		<div class="pageTitle">TracCloud Single Sign-on Configuration</div>

	TracCloud supports SAML, CAS, and LDAP for user authentication. Information on each of these options is available below.		TracCloud supports SAML, CAS, and LDAP for user authentication. Information on each of these options is available below. We can be reached at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com]

	~~We can be reached at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com]~~		===With Redrock Software Assistance===
	~~<hr>~~
	~~'''~~With Redrock Software's Assistance~~'''~~		====SAML====
	~~<hr>~~		::To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.
	==SAML==
	To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.		::<b>1. Install our Metadata</b>

			:::Available here: https://sso.trac.cloud/simplesaml/module.php/saml/sp/metadata.php/trac5-saml

			::<b>2. Send us your Metadata</b>

	~~<big>1~~. ~~Install our Metadata</big>~~		:::Either a URL or an XML file.

	:~~Available here~~: ~~https://sso.trac.cloud/simplesaml/module.php/saml/sp/metadata~~.~~php~~/~~trac5-saml~~		::<b>3. Send us a test account</b>

	~~<big>2~~. ~~Send us your Metadata</big>~~		:::This makes implementing SAML on your system significantly faster, but isn't required.

	:~~Either a URL or an XML file.~~		====CAS====
			::To setup CAS authentication:

	<~~big~~>3. ~~Send us a test account~~</~~big~~>		::<b>1. Add Redrock as an authorized service</b>
			:::Here is our URL: https://sso.trac.cloud/cas_return.php

	:~~This makes implementing SAML on~~ your ~~system significantly faster, but isn't required.~~		::<b>2. Send us your CAS settings</b>
			:::*CAS Login URL
			:::*CAS Validate URL
			:::*CAS Logout URL

	~~<hr>~~		====LDAP====
	==~~CAS~~==		::To setup LDAP authentication:
	To setup ~~CAS~~ authentication:

	<~~big~~>1. ~~Add Redrock as an authorized service~~</~~big~~>		::<b>1. Send us your LDAP settings</b>
	:~~Here is our URL~~: ~~https~~:~~//sso.trac.cloud/cas_return.php~~		:::*Server Address
			:::*Port Number
			:::*Service account name (if applicable)
			:::*Service account password (if applicable)
			:::*Base DN

	~~<big>2. Send us your CAS settings</big>~~		::Multiple base DN searches can be performed if needed.
	~~<b>~~
	:*CAS Login URL
	~~:*CAS Validate URL~~
	~~:*CAS Logout URL~~
	~~</b>~~
	~~<hr>~~
	~~==LDAP==~~
	~~To setup LDAP authentication~~:

	~~<big>1. Send us your LDAP settings</big>~~		====OIDC====
	~~<b>~~
	~~:*Server Address~~
	~~:*Port Number~~
	~~:*Service account name </b>(if applicable)<b>~~
	~~:*Service account password </b>(if applicable)<b>~~
	~~:*Base DN~~
	~~</b>~~

	~~Multiple base DN searches can~~ be ~~performed if needed~~.		::OIDC support is currently in beta. Documentation on this option will be added later.
	~~<hr>~~
	~~==OIDC==~~

	~~OIDC support is currently in beta. Documentation on this option will be added later.~~
	<hr>		<hr>
	~~'''~~Without Redrock Software's Assistance~~'''~~		===Without Redrock Software Assistance===

	If you're comfortable applying changes here and already have the information above, you can put these settings in place with any SysAdmin account. If you're having any trouble with these settings, feel free to reach out to us at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com] or by [https://helpdesk.go-redrock.com submitting a helpdesk ticket]. LDAP currently requires additional configuration not available to non-Redrock accounts, reach out to us directly if you plan on using LDAP.		If you're comfortable applying changes here and already have the information above, you can put these settings in place with any SysAdmin account. If you're having any trouble with these settings, feel free to reach out to us at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com] or by [https://helpdesk.go-redrock.com submitting a helpdesk ticket]. LDAP currently requires additional configuration not available to non-Redrock accounts, reach out to us directly if you plan on using LDAP.

Redrock at 17:48, 7 April 2026

2026-04-07T17:48:23Z

← Older revision		Revision as of 17:48, 7 April 2026
Line 63:		Line 63:
	If you're comfortable applying changes here and already have the information above, you can put these settings in place with any SysAdmin account. If you're having any trouble with these settings, feel free to reach out to us at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com] or by [https://helpdesk.go-redrock.com submitting a helpdesk ticket]. LDAP currently requires additional configuration not available to non-Redrock accounts, reach out to us directly if you plan on using LDAP.		If you're comfortable applying changes here and already have the information above, you can put these settings in place with any SysAdmin account. If you're having any trouble with these settings, feel free to reach out to us at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com] or by [https://helpdesk.go-redrock.com submitting a helpdesk ticket]. LDAP currently requires additional configuration not available to non-Redrock accounts, reach out to us directly if you plan on using LDAP.
	<HR>		<HR>
	<div ~~style~~=~~"float: left; margin-top: 0em; margin-bottom: 1em"><big~~>SAML Configuration~~</big>~~</div><div class="mw-collapsible mw-collapsed"><br><br>		<div class='collapsible'>SAML Configuration</div><div class="mw-collapsible mw-collapsed"><br><br>
	<i>Other > Other Options > Preferences > Login & Security Settings > SAML</i>		<i>Other > Other Options > Preferences > Login & Security Settings > SAML</i>
	[[File:8589517.png\|800px]]		[[File:8589517.png\|800px]]
Line 98:		Line 98:
	</div>		</div>
	<HR>		<HR>
	<div ~~style~~=~~"float: left; margin-top: 0em; margin-bottom: 1em"><big~~>CAS Configuration~~</big>~~</div><div class="mw-collapsible mw-collapsed"><br><br>		<div class='collapsible'>CAS Configuration</div><div class="mw-collapsible mw-collapsed"><br><br>

	<i>Other > Other Options > Preferences > Login & Security Settings > CAS</i>		<i>Other > Other Options > Preferences > Login & Security Settings > CAS</i>
Line 137:		Line 137:
	</div>		</div>
	<HR>		<HR>
	<div ~~style~~=~~"float: left; margin-top: 0em; margin-bottom: 1em"><big~~>Additional Login/Logout Settings~~</big>~~</div><div class="mw-collapsible mw-collapsed"><br><br>		<div class='collapsible'>Additional Login/Logout Settings</div><div class="mw-collapsible mw-collapsed"><br><br>

	After setting up the SSO protocol, there are a few optional settings to configure, detailed below.		After setting up the SSO protocol, there are a few optional settings to configure, detailed below.

Redrock at 20:19, 31 March 2026

2026-03-31T20:19:41Z

← Older revision		Revision as of 20:19, 31 March 2026
Line 9:		Line 9:

	We can be reached at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com]		We can be reached at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com]
	<~~div class="line"></div~~>		<hr>
	'''With Redrock Software's Assistance'''		'''With Redrock Software's Assistance'''
	<~~div class="line"></div~~>		<hr>
	==SAML==		==SAML==
	To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.		To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.

Redrock at 23:29, 30 March 2026

2026-03-30T23:29:12Z

← Older revision		Revision as of 23:29, 30 March 2026
Line 1:		Line 1:
	{{TracCloudGuideTabs}}		{{TracCloudGuideTabs}}
	<div class="tcWidgetPage">		<div class="tcWidgetPage">
	<div class="~~category~~">		<div class="categoryDynamic">
	{{TracCloudTechTOC}}		{{TracCloudTechTOC}}
	</div>		</div>

Redrock: Removed protection from "TracCloud: Single Sign-On"

2026-03-30T22:05:40Z

Removed protection from "TracCloud: Single Sign-On"

← Older revision	Revision as of 22:05, 30 March 2026
(No difference)

Redrock at 20:23, 5 December 2025

2025-12-05T20:23:45Z

← Older revision		Revision as of 20:23, 5 December 2025
Line 13:		Line 13:
	<div class="line"></div>		<div class="line"></div>
	==SAML==		==SAML==
	To setup SAML authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.		To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.

	<big>1. Install our Metadata</big>		<big>1. Install our Metadata</big>

Redrock at 21:42, 3 September 2025

2025-09-03T21:42:02Z

← Older revision		Revision as of 21:42, 3 September 2025
Line 54:		Line 54:

	Multiple base DN searches can be performed if needed.		Multiple base DN searches can be performed if needed.
			<hr>
			==OIDC==

			OIDC support is currently in beta. Documentation on this option will be added later.
	<hr>		<hr>
	'''Without Redrock Software's Assistance'''		'''Without Redrock Software's Assistance'''

Redrock at 21:39, 3 September 2025

2025-09-03T21:39:54Z

← Older revision		Revision as of 21:39, 3 September 2025
Line 146:		Line 146:

	* <b>Block SSO users from kiosk</b>		* <b>Block SSO users from kiosk</b>
	::If enabled, anyone who logs in via SSO will not be allowed to open student-facing kiosks. This should only be enabled if your single sign-on service doesn't support single logout, otherwise if a user opens a kiosk, their campus account will still be logged in.		::If enabled, anyone who logs in via SSO will not be allowed to open student-facing kiosks. This should only be enabled if your single sign-on service doesn't support single logout, otherwise if a user opens a kiosk, their campus account will still be logged in.<br><br>

			* <b>Prevent Automatic Redirection on Index Page</b>
			::With the exception of LDAP, enabling any SSO will cause your regular TracCloud link to redirect through your single sign-on login page. If this box is checked, that will be prevented. This is typically not recommended.<br><br>

			* <b>Activation Session Expiration</b>
			::Automatically log users out after a period of inactivity. By default, logins are valid for the duration of the browser session.

	</div>		</div>

Redrock at 16:42, 29 July 2025

2025-07-29T16:42:40Z

← Older revision		Revision as of 16:42, 29 July 2025
Line 4:		Line 4:
	{{TracCloudTechTOC}}		{{TracCloudTechTOC}}
	</div>		</div>
	<~~big><b~~>TracCloud Single Sign-on Configuration</~~b></big><br~~>		<div class="pageTitle">TracCloud Single Sign-on Configuration</div>

	TracCloud supports SAML, CAS, and LDAP for user authentication. Information on each of these options is available below.		TracCloud supports SAML, CAS, and LDAP for user authentication. Information on each of these options is available below.