TracCloud: Single Sign-On - Revision history

Redrock at 22:00, 8 October 2026

2026-10-08T22:00:29Z

← Older revision		Revision as of 22:00, 8 October 2026
Line 156:		Line 156:
	:Enable the toggle option in the top-right corner of your CAS window to enable CAS authentication for future logins.		:Enable the toggle option in the top-right corner of your CAS window to enable CAS authentication for future logins.
	:[[File:J54yh545m56j5j.png\|800px]]		:[[File:J54yh545m56j5j.png\|800px]]
			</div>
			<HR>
			<div class='collapsible'>LDAP Configuration</div><div class="mw-collapsible mw-collapsed"><br><br>

			Other ➜ Other Options ➜ Preferences ➜ Login & Security Settings ➜ LDAP.

			[[File:407981.png\|800px]]
			<br><br>

			* '''Server Address'''
			: The address of your LDAP server.

			* '''Port'''
			: Typically 389 for non-secure LDAP, or 636 for secure LDAPS.

			* '''Timeout'''
			: Typically set to 30.

			* '''Uses Service Account''' and '''Name/Password'''
			: If this is a double-bind configuration where a service account needs to perform account look-ups, check this box and enter the credentials for the account.

			* '''Prepend/Append to Username for Matching'''
			: When someone enters their username to login, that username will be used for the account lookup (as opposed to SAML where additional attributes could be passed in the background). If accounts are stored with a prefix/suffix that will not be entered by the user, these fields can be used. For example, if "dsmith" is logging in, but their account is stored as "campus\dsmith", you would put "campus\" in the prepend field.

			* '''Authentication order'''
			: Choose the order accounts are authenticated in.

			* '''Student/Staff/Faculty field containing unique ID'''
			: Choose the field to match the username to, typically UserName.

			* '''LDAP field containing unique ID'''
			: The LDAP attribute, typically sAMAccountName.

			* '''LDAP Account Search Options'''
			: These are the fields where you will specify the base DNs to search in. For example, one base DN may contain students, while another may contain staff/faculty. Choose which accounts to check for in each DN, then enter the base DN into the text field below. You can perform up to three searches.

			* '''Search filter'''
			: Common values are (objectClass=user), (memberOf=example), or (cn=NOTAUSER)
	</div>		</div>
	<HR>		<HR>
Line 165:		Line 203:

	* <b>Log Off Redirect URL</b>		* <b>Log Off Redirect URL</b>
	::This is the URL that users will be taken to when logging out of TracCloud, typically used to redirect users to a page that ends their single sign-on session.~~<br><br>~~		: This is the URL that users will be taken to when logging out of TracCloud, typically used to redirect users to a page that ends their single sign-on session.

	* <b>Custom "No Access" Page URL</b>		* <b>Custom "No Access" Page URL</b>
	::By default, if a user attempts to access a page that they don't have access to, a generic "Access Denied" page will display from TracCloud. If you would prefer to override this with a different page, enter that URL here.~~<br><br>~~		: By default, if a user attempts to access a page that they don't have access to, a generic "Access Denied" page will display from TracCloud. If you would prefer to override this with a different page, enter that URL here.

	* <b>Block SSO users from kiosk</b>		* <b>Block SSO users from kiosk</b>
	::If enabled, anyone who logs in via SSO will not be allowed to open student-facing kiosks. This should only be enabled if your single sign-on service doesn't support single logout, otherwise if a user opens a kiosk, their campus account will still be logged in.~~<br><br>~~		: If enabled, anyone who logs in via SSO will not be allowed to open student-facing kiosks. This should only be enabled if your single sign-on service doesn't support single logout, otherwise if a user opens a kiosk, their campus account will still be logged in.

	* <b>Prevent Automatic Redirection on Index Page</b>		* <b>Prevent Automatic Redirection on Index Page</b>
	::With the exception of LDAP, enabling any SSO will cause your regular TracCloud link to redirect through your single sign-on login page. If this box is checked, that will be prevented. This is typically not recommended.~~<br><br>~~		: With the exception of LDAP, enabling any SSO will cause your regular TracCloud link to redirect through your single sign-on login page. If this box is checked, that will be prevented. This is typically not recommended.

	* <b>Activation Session Expiration</b>		* <b>Activation Session Expiration</b>
	::Automatically log users out after a period of inactivity. By default, logins are valid for the duration of the browser session.		: Automatically log users out after a period of inactivity. By default, logins are valid for the duration of the browser session.

	</div>		</div>

Redrock at 17:50, 8 October 2026

2026-10-08T17:50:25Z

← Older revision		Revision as of 17:50, 8 October 2026
Line 97:		Line 97:
	:* <b>Install your Metadata in the Primary Metadata field</b>		:* <b>Install your Metadata in the Primary Metadata field</b>
	:::[[File:2807471.png\|500px]]		:::[[File:2807471.png\|500px]]
	:::After submitting, your Entity ID field will be populated automatically. ~~If you require a~~ duel-tenant ~~configuration~~, ~~reach out~~ to us at ~~[mailto~~:~~helpdesk@~~go-redrock.com ~~helpdesk@~~go-redrock.com~~] for assistance~~.~~<br><br>~~		:::After submitting, your Entity ID field will be populated automatically.
			:::In the event that duel tenant authentication is required (e.g., one metadata file for staff, another for students), you will simply need to add the additional metadata links/files to the secondary/tertiary fields as needed. Users would then navigate the relevant URL in order to login, shown below. Replace with your campus URL as needed.

			:::Primary metadata would be used if accessing the system at:
			:::https://traccloud.go-redrock.com/demo/trac/index.php?saml_mt=1

			:::Secondary metadata would be used if accessing the system at:
			:::https://traccloud.go-redrock.com/demo/trac/index.php?saml_mt=2

			:::Tertiary metadata would be used if accessing the system at:
			:::https://traccloud.go-redrock.com/demo/trac/index.php?saml_mt=3

	<big>3. Retrieve your attributes</big>		<big>3. Retrieve your attributes</big>

Redrock at 18:05, 3 August 2026

2026-08-03T18:05:37Z

@@ Line 57: / Line 57: @@
 If you're comfortable applying changes here and already have the information above, you can put these settings in place with any SysAdmin account. If you're having any trouble with these settings, feel free to reach out to us at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com] or  by [https://helpdesk.go-redrock.com submitting a helpdesk ticket]. LDAP currently requires additional configuration not available to non-Redrock accounts, reach out to us directly if you plan on using LDAP.
 <HR>
 <div class='collapsible'>SAML Configuration</div><div class="mw-collapsible mw-collapsed"><br><br>

Redrock at 18:12, 17 June 2026

2026-06-17T18:12:29Z

← Older revision		Revision as of 18:12, 17 June 2026
Line 1:		Line 1:
			<div class="categoryDynamic">
	{{TracCloudGuideTabs}}		{{TracCloudGuideTabs}}
	~~<div class="tcWidgetPage">~~
	~~<div class="categoryDynamic">~~
	{{TracCloudTechTOC}}		{{TracCloudTechTOC}}
	</div>		</div>
Line 158:		Line 157:

	[[Category:TracCloud Manual]]		[[Category:TracCloud Manual]]
	~~</div>~~

Redrock at 23:35, 12 June 2026

2026-06-12T23:35:45Z

← Older revision		Revision as of 23:35, 12 June 2026
Line 60:		Line 60:
	<HR>		<HR>
	<div class='collapsible'>SAML Configuration</div><div class="mw-collapsible mw-collapsed"><br><br>		<div class='collapsible'>SAML Configuration</div><div class="mw-collapsible mw-collapsed"><br><br>
	~~<i>~~Other > Other Options > Preferences > Login & Security Settings > SAML~~</i>~~		Other ➜ Other Options ➜ Preferences ➜ Login & Security Settings ➜ SAML.
	[[File:8589517.png\|800px]]		[[File:8589517.png\|800px]]

Line 96:		Line 96:
	<div class='collapsible'>CAS Configuration</div><div class="mw-collapsible mw-collapsed"><br><br>		<div class='collapsible'>CAS Configuration</div><div class="mw-collapsible mw-collapsed"><br><br>

	~~<i>~~Other > Other Options > Preferences > Login & Security Settings > CAS~~</i>~~		Other ➜ Other Options ➜ Preferences ➜ Login & Security Settings ➜ CAS.
	[[File:6231962.png\|800px]]		[[File:6231962.png\|800px]]
	<br><br>		<br><br>

Redrock at 21:41, 12 June 2026

2026-06-12T21:41:53Z

← Older revision		Revision as of 21:41, 12 June 2026
Line 11:		Line 11:

	====SAML====		====SAML====
	::To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in ~~your Trac System~~, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.		::To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in TracCloud, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.

	::<span style="color:red">Relay State URL should be left blank.</span>		::<span style="color:red">Relay State URL should be left blank.</span>
Line 78:		Line 78:

	:* <b>Authentication Order</b>		:* <b>Authentication Order</b>
	:::Your staff may have more than one account type in ~~the Trac System~~. You can use the "Authentication Order" preference to determine which account type authenticates first.		:::Your staff may have more than one account type in TracCloud. You can use the "Authentication Order" preference to determine which account type authenticates first.

	:* <b>Install your Metadata in the Primary Metadata field</b>		:* <b>Install your Metadata in the Primary Metadata field</b>
Line 140:		Line 140:

	* <b>Log Off Redirect URL</b>		* <b>Log Off Redirect URL</b>
	::This is the URL that users will be taken to when logging out of ~~the Trac System~~, typically used to redirect users to a page that ends their single sign-on session.<br><br>		::This is the URL that users will be taken to when logging out of TracCloud, typically used to redirect users to a page that ends their single sign-on session.<br><br>

	* <b>Custom "No Access" Page URL</b>		* <b>Custom "No Access" Page URL</b>

Redrock at 19:09, 20 April 2026

2026-04-20T19:09:39Z

← Older revision		Revision as of 19:09, 20 April 2026
Line 12:		Line 12:
	====SAML====		====SAML====
	::To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.		::To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.

			::<span style="color:red">Relay State URL should be left blank.</span>

	::<b>1. Install our Metadata</b>		::<b>1. Install our Metadata</b>

Redrock at 16:43, 10 April 2026

2026-04-10T16:43:03Z

← Older revision		Revision as of 16:43, 10 April 2026
Line 6:		Line 6:
	<div class="pageTitle">TracCloud Single Sign-on Configuration</div>		<div class="pageTitle">TracCloud Single Sign-on Configuration</div>

	TracCloud supports SAML, CAS, and LDAP for user authentication. Information on each of these options is available below.		TracCloud supports SAML, CAS, and LDAP for user authentication. Information on each of these options is available below. We can be reached at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com]

	~~We can be reached at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com]~~		===With Redrock Software Assistance===
	~~<hr>~~
	~~'''~~With Redrock Software's Assistance~~'''~~		====SAML====
	~~<hr>~~		::To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.
	==SAML==
	To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.		::<b>1. Install our Metadata</b>

			:::Available here: https://sso.trac.cloud/simplesaml/module.php/saml/sp/metadata.php/trac5-saml

			::<b>2. Send us your Metadata</b>

	~~<big>1~~. ~~Install our Metadata</big>~~		:::Either a URL or an XML file.

	:~~Available here~~: ~~https://sso.trac.cloud/simplesaml/module.php/saml/sp/metadata~~.~~php~~/~~trac5-saml~~		::<b>3. Send us a test account</b>

	~~<big>2~~. ~~Send us your Metadata</big>~~		:::This makes implementing SAML on your system significantly faster, but isn't required.

	:~~Either a URL or an XML file.~~		====CAS====
			::To setup CAS authentication:

	<~~big~~>3. ~~Send us a test account~~</~~big~~>		::<b>1. Add Redrock as an authorized service</b>
			:::Here is our URL: https://sso.trac.cloud/cas_return.php

	:~~This makes implementing SAML on~~ your ~~system significantly faster, but isn't required.~~		::<b>2. Send us your CAS settings</b>
			:::*CAS Login URL
			:::*CAS Validate URL
			:::*CAS Logout URL

	~~<hr>~~		====LDAP====
	==~~CAS~~==		::To setup LDAP authentication:
	To setup ~~CAS~~ authentication:

	<~~big~~>1. ~~Add Redrock as an authorized service~~</~~big~~>		::<b>1. Send us your LDAP settings</b>
	:~~Here is our URL~~: ~~https~~:~~//sso.trac.cloud/cas_return.php~~		:::*Server Address
			:::*Port Number
			:::*Service account name (if applicable)
			:::*Service account password (if applicable)
			:::*Base DN

	~~<big>2. Send us your CAS settings</big>~~		::Multiple base DN searches can be performed if needed.
	~~<b>~~
	:*CAS Login URL
	~~:*CAS Validate URL~~
	~~:*CAS Logout URL~~
	~~</b>~~
	~~<hr>~~
	~~==LDAP==~~
	~~To setup LDAP authentication~~:

	~~<big>1. Send us your LDAP settings</big>~~		====OIDC====
	~~<b>~~
	~~:*Server Address~~
	~~:*Port Number~~
	~~:*Service account name </b>(if applicable)<b>~~
	~~:*Service account password </b>(if applicable)<b>~~
	~~:*Base DN~~
	~~</b>~~

	~~Multiple base DN searches can~~ be ~~performed if needed~~.		::OIDC support is currently in beta. Documentation on this option will be added later.
	~~<hr>~~
	~~==OIDC==~~

	~~OIDC support is currently in beta. Documentation on this option will be added later.~~
	<hr>		<hr>
	~~'''~~Without Redrock Software's Assistance~~'''~~		===Without Redrock Software Assistance===

	If you're comfortable applying changes here and already have the information above, you can put these settings in place with any SysAdmin account. If you're having any trouble with these settings, feel free to reach out to us at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com] or by [https://helpdesk.go-redrock.com submitting a helpdesk ticket]. LDAP currently requires additional configuration not available to non-Redrock accounts, reach out to us directly if you plan on using LDAP.		If you're comfortable applying changes here and already have the information above, you can put these settings in place with any SysAdmin account. If you're having any trouble with these settings, feel free to reach out to us at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com] or by [https://helpdesk.go-redrock.com submitting a helpdesk ticket]. LDAP currently requires additional configuration not available to non-Redrock accounts, reach out to us directly if you plan on using LDAP.

Redrock at 17:48, 7 April 2026

2026-04-07T17:48:23Z

← Older revision		Revision as of 17:48, 7 April 2026
Line 63:		Line 63:
	If you're comfortable applying changes here and already have the information above, you can put these settings in place with any SysAdmin account. If you're having any trouble with these settings, feel free to reach out to us at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com] or by [https://helpdesk.go-redrock.com submitting a helpdesk ticket]. LDAP currently requires additional configuration not available to non-Redrock accounts, reach out to us directly if you plan on using LDAP.		If you're comfortable applying changes here and already have the information above, you can put these settings in place with any SysAdmin account. If you're having any trouble with these settings, feel free to reach out to us at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com] or by [https://helpdesk.go-redrock.com submitting a helpdesk ticket]. LDAP currently requires additional configuration not available to non-Redrock accounts, reach out to us directly if you plan on using LDAP.
	<HR>		<HR>
	<div ~~style~~=~~"float: left; margin-top: 0em; margin-bottom: 1em"><big~~>SAML Configuration~~</big>~~</div><div class="mw-collapsible mw-collapsed"><br><br>		<div class='collapsible'>SAML Configuration</div><div class="mw-collapsible mw-collapsed"><br><br>
	<i>Other > Other Options > Preferences > Login & Security Settings > SAML</i>		<i>Other > Other Options > Preferences > Login & Security Settings > SAML</i>
	[[File:8589517.png\|800px]]		[[File:8589517.png\|800px]]
Line 98:		Line 98:
	</div>		</div>
	<HR>		<HR>
	<div ~~style~~=~~"float: left; margin-top: 0em; margin-bottom: 1em"><big~~>CAS Configuration~~</big>~~</div><div class="mw-collapsible mw-collapsed"><br><br>		<div class='collapsible'>CAS Configuration</div><div class="mw-collapsible mw-collapsed"><br><br>

	<i>Other > Other Options > Preferences > Login & Security Settings > CAS</i>		<i>Other > Other Options > Preferences > Login & Security Settings > CAS</i>
Line 137:		Line 137:
	</div>		</div>
	<HR>		<HR>
	<div ~~style~~=~~"float: left; margin-top: 0em; margin-bottom: 1em"><big~~>Additional Login/Logout Settings~~</big>~~</div><div class="mw-collapsible mw-collapsed"><br><br>		<div class='collapsible'>Additional Login/Logout Settings</div><div class="mw-collapsible mw-collapsed"><br><br>

	After setting up the SSO protocol, there are a few optional settings to configure, detailed below.		After setting up the SSO protocol, there are a few optional settings to configure, detailed below.

Redrock at 20:19, 31 March 2026

2026-03-31T20:19:41Z

← Older revision		Revision as of 20:19, 31 March 2026
Line 9:		Line 9:

	We can be reached at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com]		We can be reached at [mailto:helpdesk@go-redrock.com helpdesk@go-redrock.com]
	<~~div class="line"></div~~>		<hr>
	'''With Redrock Software's Assistance'''		'''With Redrock Software's Assistance'''
	<~~div class="line"></div~~>		<hr>
	==SAML==		==SAML==
	To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.		To setup SAML or Shibboleth authentication, the following steps will need to be completed. <span style="color:red">At least one of the attributes being sent must match the contents of the username field in your Trac System, typically the first part of the email address. We can also use ID number, full email address, or other unique identifiers, but handle/username is preferred.</span> Single logout (SLO) must be enabled for security purposes. Only SP Initiated sign-ins are supported, IDP initiated sign-ins are not supported at this time.