Skip to content

SSO

imc Express can be connected directly to the imc Learning Suite or to your IDP via OpenID Connect or SAML.

Via imc Learning Suite

In this case, you do not need to perform a new SSO configuration on your IDP. We recommend this configuration to all customers who already use the imc Learning Suite.

Procedure:

  • User opens imc Express (e.g. via imc Learning Suite navigation).
  • imc Express starts authentication with imc Learning Suite (OpenID Connect).
  • imc Learning Suite performs SSO with your IDP or the user logs in directly to imc Learning Suite.
  • imc Learning Suite has authenticated the user and forwards them to imc Express.
  • User is authenticated and his user profile has been imported from your imc Learning Suite.

Advantages:

  • imc takes care of the integration of the applications - you only have the SSO interface (imc Learning Suite).
  • imc Express is able to communicate directly with imc Learning Suite (prerequisite for direct publishing of imc Express content in imc Learning Suite).
  • Changes/maintenance of the SSO integration must only be carried out on imc Learning Suite.

Technical details:

Via OpenID Connect or SAML

imc Express can perform SSO via OpenID Connect or SAML with your IDP (e.g. Microsoft Entra ID / AD).

Procedure:

  • User opens imc Express.
  • imc Express starts authentication with your IDP (via OpenID Connect or SAML).
  • User will be redirected to your IDP.
  • User logs on to your IDP.
  • IDP forwards users to imc Express.
  • User is authenticated and his user profile has been imported from your IDP.

SSO data sharing documentation

Following user data is received and stored when using SSO in imc Express.

Concerning SSO connection directly to imc Express via SAML/OpenID we need following claims:

  • unique User Identifier user.userprincipalname
  • email address user.mail
  • full name user.userprincipalname
  • given name user.givenname
  • family name user.surname


As for SSO via ILS, imc Express receives the following user attributes from the ILS identity token:

  • unique user identifier (sub) - required
  • email address - optional
  • full name - optional
  • given name - optional
  • family name - optional
  • preferred language - optional
  • gender - optional
  • organization - optional

Name and email may alternatively be passed alongside the token if missing from it. Only the user identifier is stored permanently (for license assignment and audit logging); the remaining attributes are used for the user's session in imc Express. No data is sent back from imc Express to the ILS as part of the SSO process.