Set up SSO with SAML

Yarno supports single sign-on through SAML 2.0, so your people can sign in with the account they already use at work. Any SAML 2.0 identity provider (IdP) works, including Microsoft Entra ID, Okta and PingFederate.

Setup takes three steps: create a Yarno app in your IdP, enter your IdP's details in Yarno, then enable SAML sign ins once you've tested.

1. Create a Yarno app in your identity provider

In Yarno, an account admin goes to Account settings → SAML settings. The Service Provider configuration details section shows the two values your IdP needs:

• Entity ID (audience): yarno.com.au
• ACS URL (reply URL): unique to your account, in the form below

https://learn.yarno.com.au/auth/saml/{your-account}/consume

Copy the ACS URL from the SAML settings page rather than from this article. If your IdP can import service provider metadata, the same values are available at:

https://learn.yarno.com.au/auth/saml/{your-account}/metadata

Create a SAML application in your IdP with those values, set the NameID and claims (see below), and assign the people who should have access.

2. Enter your IdP's details in Yarno

Back in SAML settings, under Identity Provider configuration details:

• Sign in URL: your IdP's SAML sign-on URL. This is where Yarno redirects learners to sign in.
• X509 signing certificate: your IdP's public signing certificate, in PEM or Base64 CER format. Yarno shows the certificate's expiry date once it's uploaded.

Click Update SAML settings.

3. Test, then enable

With the details saved but Enable SAML sign ins? still unticked, test the connection with one assigned user. Have them open your account's SAML sign in URL directly:

https://learn.yarno.com.au/auth/saml/{your-account}/new

It's the same as your ACS URL with /consume replaced by /new. It works before SAML sign ins are enabled, so nobody else on the account is affected while you test. A successful sign in lands the person on their Yarno dashboard.

When you're happy, tick Enable SAML sign ins? and click Update SAML settings. From then on, everyone on the account signs in through your IdP, including admins and managers. Nobody on the account uses a Yarno password.

Getting people into Yarno

SSO controls who can sign in. Each person also needs a learner profile on your Yarno account. There are four ways to create one:

• CSV upload. Your Yarno admin adds people in bulk under Learners → Bulk add (name, email, job title, teams, and employee ID if you use one). On first sign in, Yarno matches the person to their profile by NameID, or by email or employee ID depending on your NameID format, and links them silently. Good for a known cohort before launch.
• Campaign invite links. The most common path for SSO accounts. Each campaign has a shareable invite URL. A person opens it, enters their work email, is sent through your IdP to sign in, then lands on a short sign up form pre-filled from your claims. Only email addresses on the domains you've registered with us are accepted, so tell us your domains during setup. Ask us to turn invite links on.
• Just-in-time sign up. Available on request. Anyone assigned to the Yarno app in your IdP who has no Yarno profile is shown the sign up form on first sign in, from any Yarno page rather than a campaign link.
• SCIM and automated provisioning. Yarno doesn't support SCIM today. If you'd like to keep Yarno in sync with your directory automatically, talk to us about what you need.

When you remove someone's access in your IdP they can no longer sign in, but their Yarno profile remains until your Yarno admin retires them. Add “retire in Yarno” to your leaver process.

What Yarno reads from the SAML assertion

NameID

NameID is how Yarno recognises a person. It's stored on first sign in and must never change, so use a stable value such as the person's work email (emailAddress format) or employee ID (persistent format). Don't use transient NameIDs.

People your Yarno admin has already added are matched by NameID, so nothing else in the assertion is needed for them. Claims are only used to pre-fill the sign up form when someone signs in for the first time without an existing Yarno profile (just-in-time sign up or a campaign invite link). Every field on that form can be edited, so a missing claim just means the person types it themselves.

Claims

Yarno reads the part of each claim name after the last slash, so http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname is read as givenname. The sign up form is pre-filled from:

• Name: first_name or givenname, plus last_name or surname. Yarno stores one name field, so the two claims are joined as “First Last”.
• Nickname: first_name. This is what Yarno calls the person in campaigns.
• Email: email
• Employee ID: custom_identifier or uid (optional)

A couple of things worth knowing:

• Entra ID's default claims are givenname, surname and emailaddress. Name is pre-filled from the first two; emailaddress isn't read, so the person types their email on the form. Add a claim named email if you'd like it pre-filled.
• Groups, roles, department and job title claims aren't read. Teams and job titles are chosen on the sign up form or set by your Yarno admin.
• Claims are read once, at sign up. Later changes in your directory don't update the person's Yarno profile.

Need help?

Your customer success manager can bring one of our engineers onto a setup call. If sign in fails after go-live, send support a screenshot of the error and the time it happened, and check that the person is assigned to the Yarno app in your IdP.