CITI Program offers Single Sign On (SSO) options for sites to allow their learners to log in via their institutions' credentials. If you are unfamiliar with SSO, read a summary of its advantages. This page provides technical details about our standard implementations.

Note that our recommended solution is via InCommon membership or for organizations outside the U.S., joining an eduGAIN member federation. InCommon/eduGAIN members can elect a standard implementation at a lower price. We also support several non-InCommon implementation options but at a higher price. See our FAQs, Do you support..? below for more information.

All SSO implementations require payment. Generally, the fee is $500 for an InCommon setup or $1000 for a non-InCommon setup; then a $150 annual maintenance fee starting the second year. See pricing details and FAQs here.
 

• Getting Started
• Policies & Procedures
• Attributes
• Automatic Enrollment Links
• General Q & A

Getting Started

Shibboleth is an open-source SOAP service that many institutions are adopting to make connecting identity providers (IdPs) to service providers (SPs) easier and more secure. In this case, CITI Program is the service provider. Organizations subscribing to CITI Program services are the identity providers for their learners and administrators.

We are currently registered with the federated identity provider InCommon.

Integrations

• Microsoft Entra (Azure AD) - https://learn.microsoft.com/en-us/entra/identity/saas-apps/citi-program-tutorial
• Okta - https://www.okta.com/integrations/citi-program/

Policies and Procedures

If your organization wishes to connect its learners and administrators with CITI Program via a standard SSO method, please contact us to create a ticket for your request. In order to provide you with a quote, we will need to know which identity provider (IdP) your organization will use to set up SSO. To search InCommon, find your Institution, click on the Identity Provider link, and copy the URL into the email request.

Setup begins once payment is confirmed. We will need your technical contact who will be enabling SSO for CITI Program on your server, and if you elect to get the member cleanup service, we need your identity management contact in charge of matching already-existing CITI Program accounts and those of your institution.

Return

Frequently Asked Questions

• What is the cost of connecting?
  • The cost for a standard Shibboleth implementation for one institution (if your organization is a member of InCommon) is $500, plus an annual maintenance fee of $150. If you have multiple institutions against a single IdP to set up at the same time, discounted rates may apply. Discounts can also apply if you decide to add an additional institution later against the same IdP. Contact our Sales Department for a quote.
  • If you are not a member of InCommon but are using a standard SAML 2.0 method, the usual implementation charge is $1000. However, the method must be confirmed as approved as standard.
  • We also offer a data cleanup and member-matching service to match legacy records to the new SSO credentials.
    • Please see this dedicated article for more detail: https://support.citiprogram.org/s/article/Member-Matching-Data-Cleanup-Service
  • If you need special custom programming, such as custom metadata attributes, there are also additional fees based on the amount of programmer and administrative time involved in setting up and maintaining the configuration. Contact our Sales Department for a quote.
• How will the Shibboleth SSO impact the data loads of course completion scores pulled nightly from the CITI database to our employee record system?
  • They will generally be much more accurate, relying on information sent as part of the SSO login rather than the learner's own data entry (which often contains unintended errors). Other fields remain untouched. Identification can use the inaccessible SSO Institution User ID (eduPersonPrincipalName EPPN [EmployeeID]@[Institution].edu). Shibboleth sends it directly from the institution and is saved on that learner's record for the reports. We can coordinate with your team to add the unique identifier (Institution Username) or other optional attributes to your report columns.
• Do you have Just-In-Time provisioning? How does the interface handle existing accounts when a member logs in?
  • The interface tries to match the Institution ID + Institution Username. If no match is found, the learner is given options to either self-match by logging in with their CITI Program credentials or create a new account.
    • This one-time prompt can be viewed here.
• How are members that are no longer affiliated with our institution affected by SSO?
  • Members can always log in via their CITI credentials (Username & Password on the CITI homepage). Institutional administrators also may remove members from their institution as needed. The members still retain access to their completions under the institution if they are unaffiliated.
• Do you support [Identity Provider]?
  • In general, any SAML 2.0 implementation can be supported. We currently support sites using ADFS, Entra ID (Azure AD), Duo, Ellucian, Google Workspace, Idaptive, Okta, OneLogin, Ping, QuickLaunch, Rippling, Secret Double Octopus, Shibboleth, Simple SAMLPHP, Thales, VMware Workspace ONE, and WSO2. For sites using ADFS, Microsoft recommends migrating to Entra ID.
  • We have integrations with Entra ID and Okta currently.
• Can learners be enrolled in courses using SSO?
  • We've allowed for a StageID URL parameter to be passed in the SSO link. It allows unique links to be created for the purpose of enrolling learners in a course or set of courses. See Automatic Enrollment Links.
• Learn more:
  • Shibboleth: http://shibboleth.net
  • InCommon: https://incommon.org

Return

Entity Information

• EntityID: https://www.citiprogram.org/shibboleth
• Reply URL (Assertion Consumer Service URL): https://www.citiprogram.org/Shibboleth.sso/SAML2/POST
• Metadata URL: https://www.citiprogram.org/SAML/CITIProgramMetadata.xml

Required Attributes

Claim Names are accepted based on attribute format. See Known Integration Default Attribute Formats for reference if unsure. Common Attribute / Claim Settings below may also be of assistance.

Requested Attributes

Optional Attributes

For more information on attributes, see eduPerson Object Class Specification

Common Attribute / Claim Settings

Most common for Azure, ADFS, Okta, and others with Unspecified default attribute format (attrname-format:unspecified).

Most common for QuickLaunch, WSO2, and others with Basic default attribute format (attrname-format:basic).

Identity Management Attribute Information

EPPN

sn

givenName

mail

displayName

studentNumber

employeeNumber

eduPersonScopedAffiliation

eduPersonAffiliation

Known Integration Default Attribute Formats

Automatic Enrollment Links

A StageID URL parameter can be passed in the SSO link. It allows unique links to be created for the purpose of enrolling learners in a course or set of courses.

For example, if your SSO link is:

https://www.citiprogram.org/Shibboleth.sso/Login?target=https%3A%2F%2Fwww.citiprogram.org%2FSecure%2FWelcome.cfm%3finst%3d0000&entityID=https%3A%2F%2Fexample.entity.id%2Fidp

Add the StageID parameter directly after the "inst" parameter, and note to URL-encode the ampersand (& → %26) and equals sign (= → %3d).

https://www.citiprogram.org/Shibboleth.sso/Login?target=https%3A%2F%2Fwww.citiprogram.org%2FSecure%2FWelcome.cfm%3finst%3d0000%26stageID%3d12345,23456&entityID=https%3A%2F%2Fexample.entity.id%2Fidp

This also works with the short links to your SSO and, due to readability, is probably preferred.

https://www.citiprogram.org/portal?site=0000&stageID=12345,23456

StageIDs for courses can be found via the Admin Reports menu on the Active Courses Being Used page.

Please see the dedicated article for more details: https://support.citiprogram.org/s/article/Automatic-Enrollment-Links

Return

Contact the CITI Program for more information