...
...
...
...
...
...
...
...
...
...
...
Overview
Welcome! This page is to help district implement Google Single Sign-on (SSO) into the PowerSchool login process. PowerSchool’s official documentation is available here: PowerSchool's instructions.
If you are a NBEC/NWOCA member district, feel free to reach out to our IT Services team with any questions.
Step 1: Enable PowerSchool SIS as OIDC Service Provider
...
In your new tab, go here https://console.developers.google.com/.
Select Create Project
Give your project any name you want.
Make sure that the org and location fields are set to your Google domain and then click on "Create."
Please wait while your project is created. A notification will appear confirming its creation. Once the notification is displayed, you can click on Select Project.
You should be taken to the dashboard for your project. Click on the navigation menu.
Select APSs & Services then OAuth consent screen.
For "User Type" select "External" and then "Create"
Name your app, specify a support email address in the User Support Email field, and optionally add a logo.
For the App Domain section, put your PowerSchool website address in the first field. Leave the next two fields blank.
For "Authorized Domains" click on "Add Domain" and enter the name of your Google domain (hilltopcadets.org, fayettesch.org, etc.) and nwoca.org.
Enter an email address for the Developer Contact Information, then click Save and Continue.
Click Save and Continue for step 2 Scopes and step 3 Test users, then select Back to Dashboard at the bottom of the summary page.
On the left of the screen, click on Credentials.
After the Credentials page loads, click on +Create Credentials, then select OAuth Client ID.
For application type select Web Application and give it a name.
Under Authorized Redirect URIs, click on Add URI
Enter your PowerSchool address followed by /oidc/openid_connect_login
Next, click on Create.
A pop-up window will appear with the Client ID and Client Secret. Copy and paste these into a text document as they will be needed later. You can close Google Cloud and return to PowerSchool for Step 3.
...
On the start page within the PowerSchool SIS Admin portal, choose System Management in the left-hand menu.
System Management will open, and select Security.
Click OIDC Authentication.
Select Add.
In the user dropdown select the user type you want.Note: If all three options are needed repeat steps 5 - 10 for each user dropdown.
Enter https://accounts.google.com for the IDP URL.
Enter the client ID and client secret that was received from Google Cloud during Part 2: Configure the Google Web App.
Enter openid email for the Scopes field.
For Authentication ID / Identifying Claim, enter email.
Check the Enable OIDC Authentication for the personas you need.
Note: Users will be signed out of PowerSchool once these are checked, you can wait to enable this once you have finished the rest of the setup.
Click Submit.
Step 4: Map Users from Google to PowerSchool
...
On the start page within the PowerSchool SIS Admin portal, choose Data and Reporting in the left-hand menu.
Data and Reporting will open, then select Export.
Under Export click Data Export Manager.Â
In the Select Columns to Export section:
Choose PowerSchool Data Sets as the Category.
Choose one of the following from Export From. Note - : You will need to run this multiple times if you need to export all users.
**Warning: To get all of your Staff and Teachers you need to export both the Staff Mapping and Teacher Mapping**SSO Staff Mapping
SSO Teacher Mapping
SSO Parent Mapping
SSO Student Mapping
Select the columns to export, it is helpful to also include email or first and last name so it is easier to identify the user in the CSV file.
For Staff and Teacher, User DCID, SSO User Type, Global Identifier are required.
For Parent, Person ID, SSO User Type, Global Identifier are required.
For Student, Student DCID, SSO User Type, Global Identifier are required.
Click Next.
In the Select/Edit Records section, you can use the Built In Filters to narrow the list of records to export, then click Next.
In the Export Summary and Output Options section:
Change the Export File Name extension from .txt to .csv.
Choose Comma as the Field Delimiter.
Choose UTF-8 as the Character Set.
Click Export.
...
Open the CSV file you exported.
In the export, you will need to add the email address to the corresponding User. This is where exporting the email address or name is helpful.
Once the Global Identifier field has been updated you can delete the additional columns you exported.
Part C: Import Merdged Data to PowerSchool
...
Step 6: Test SSO for Users
Note: If you did not check the Enable OIDC Authentication in Step 3, #10 you will need to do that before attempting to test SSO.
After mapping the users from the Google to PowerSchool SIS, test the SSO connection. Be sure to test each persona in another browser or using an incognito window before ending your current session.
...