Activating Google SSO for your Myschool users

If you are looking for an SSO solution for your MySchool portal, then we can help you with this. MySchool is SAML compliant.

Our most requested integration is with Google accounts. If you have another system in mind, then please contact our support team to see if we can help you.

Please note that the primary email within your MySchool system must be the same as your Gmail directory. Why not try out the mass edit tool to help update your users.

Not all of your user base would need to have this activated, most schools choose staff and students to have SSO enabled, whereas guardians still access your system via the default login settings. Look at the hybrid solution available. 

Step 1: Send us the XML data

• Send a ticket to our support team to inform them of your wish to set up Google SSO. 
• On your Google administrator panel, go to the section called 'Apps'.
• Click on SAML Apps.
• Choose the plus icon in the bottom right-hand corner of the screen.
• Select 'Set up my own custom app'.
• Download the GoogleIDPMetaData.XML.
• Send this to our support team.

Our development team will add this to your MySchool portal. This is not immediate and will be dealt with according to development availability.

Step 2: Adding the ACS URL and confirming the entity ID

• Your CSM will confirm when you can finish off the integration. you will need to go through the same steps as above to reach the XML page in Step 1.
• Now you can click next, after the XML page, you will be required to give a label to the App. It is not important how you name the App. Once named, click Next.  
• Now we need to set the Login check. You will be asked to confirm the ACS URL on Google to be https://YOURSCHOOLINSTANCE.MSM.IO/saml/login_check
• Again the entity id needs to be set as https://YOURSCHOOLINSTANCE.MSM.IO/entity.

NB: Replace yourschoolinstance with the actual URL your school uses to access the portal.

• After these fields are entered, click Next in the Google app creator screens.

Step 3: Confirming the attributes mapping

• Now we need to map attributes for MySchool and Google to confirm the identity of your users. Add new mapping if these are not showing already.
• The three fields you must use and copy exactly are;

first_name / Basic information / First name last_name / Basic information / Last name email / Basic information / Primary Email Please do not change or use any other attribute.

• Finish the Google wizard, and enable it by clicking on the three dots in the top left-hand corner of their page.
• To enable SSO, you can select 'On for everyone. Before doing this note that it will be effective immediately, make sure you have communicated this with your users. Ideally, we suggest outside of school operational hours.
• Your staff and students should now be able to log into MySchool once they have logged into their Google account.

Step 4: Check the security tab

You will notice after we have enabled the XML data, a new field will appear in the security of students and users. This field will determine how the user can access your MySchool portal using SSO.

If it is set to 1 then the user must use the SSO option and cannot log in normally. If set to 0 then the user can use MySchool primary email and their MySchool password. We have options to use mass edit or for larger schools, we can enable this for a population (i.e. for all staff and students or just staff for example).

Time out landing pages

Users have a default 300min to be logged into MySchool with no activity. Our default behaviour is to return users to our login portal. This may be frustrating for SSO enabled schools, as they would need to go back to Google and restart the verification process.

To resolve this we can add a redirect page URL for your portal. This could be your school website, or simply google.com. Provide us with the URL and we can set it up in your system settings.

Hybrid solution for the login screen

In many cases, as we explained above, schools will choose to have a hybrid solution. Whereby staff and students will use SSO, but guardians and others will use the default login page.

We can adapt the login page to show two options for your users. 

Ps: Don't forget that you can change the logo and background screen. Why not run a competition with your students and the best design will be used. You can change it as often as you want, so why not add seasonal themes for your community? Have a look at this article for further information.