Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Version History

« Previous Version 6 Next »

Click this link to go to PowerSchool's instructions.

Step 1: Enable PowerSchool SIS as OIDC Service Provider

The first step in setting up PowerSchool SIS as OIDC Service Provider is to enable the plugin. 

  1. On the start page within the PowerSchool SIS Admin portal, choose System Management in the left-hand menu.

  2. System Management will open, then select Server.

  3. Under Server Setup click Plugin Configuration. 

    image-20250116-180858.png

  4. On the Plugin Configuration Page scroll down to PowerSchool SIS as OIDC Service Provider, then select Enable/Disable so the box is checked.

    image-20250116-181528.png

  5. After you select the checkbox you will be presented with this screen, Click Enable. You can return to the main PowerSchool page and open a new tab in your web browser.

    image-20250116-182311.png

Step 2: Configure the Google Web App

  1. In your new tab, go here https://console.developers.google.com/.

  2. Select Create Project

    image-20250116-182953.png

  3. Give your project any name you want.

  4. Make sure that the org and location fields are set to your Google domain and then click on "Create."

    image-20250116-183216.png

  5. Please wait while your project is created. A notification will appear confirming its creation. Once the notification is displayed, you can click on Select Project.

    image-20250116-183307.png

  6. You should be taken to the dashboard for your project. Click on the navigation menu.

    image-20250116-184717.png

  7. Select APSs & Services then OAuth consent screen.

    image-20250116-184805.png

  8. For "User Type" select "External" and then "Create"

    image-20250116-184913.png

  9. Name your app, specify a support email address in the User Support Email field, and optionally add a logo.

    image-20250116-185218.png

  10. For the App Domain section, put your PowerSchool website address in the first field. Leave the next two fields blank.

    image-20250116-185621.png

  11. For "Authorized Domains" click on "Add Domain" and enter the name of your Google domain (hilltopcadets.org, fayettesch.org, etc.) and nwoca.org.

    image-20250116-190128.png

  12. Enter an email address for the Developer Contact Information, then click Save and Continue.

  13. Click Save and Continue for step 2 Scopes and step 3 Test users, then select Back to Dashboard at the bottom of the summary page.

    image-20250116-191829.png

    image-20250116-191945.png

  14. On the left of the screen, click on Credentials.

    image-20250116-192048.png

  15. After the Credentials page loads, click on +Create Credentials, then select OAuth Client ID.

    image-20250116-192424.png

  16. For application type select Web Application and give it a name.

  17. Under Authorized Redirect URIs, click on Add URI

  18. Enter your PowerSchool address followed by /oidc/openid_connect_login

    image-20250116-194246.png

  19. Next, click on Create.

  20. A pop-up window will appear with the Client ID and Client Secret. Copy and paste these into a text document as they will be needed later. You can close Google Cloud and return to PowerSchool for Step 3.

    image-20250116-194712.png

Step 3: Link Google to Powerschool

  1. On the start page within the PowerSchool SIS Admin portal, choose System Management in the left-hand menu.

  2. System Management will open, and select Security.

  3. Click OIDC Authentication.

    image-20250116-195617.png

  4. Select Add.

  5. In the user dropdown select the user type you want. If all three options are needed repeat steps 5 - 10 for each user dropdown.

    image-20250116-200103.png

  6. Enter https://accounts.google.com for the IDP URL.

  7. Enter the client ID and client secret that was received from Google Cloud during Part 2: Configure the Google Web App.

  8. Enter openid email for the Scopes field.

  9. For Authentication ID / Identifying Claim, enter email.

  10. Check the Enable OIDC Authentication for the personas you need.

  11. Click Submit.

    image-20250116-201636.png

Step 4: Map Users from Google to PowerSchool

Part A: Export PowerSchool SIS Users

The first step in mapping users from Google to PowerSchool SIS is to export users from PowerSchool SIS. All active users must be set up for SSO before exporting. The Global Identifier for the User Type of Staff is used to sign in to the PowerSchool Admin portal and the Global Identifier for User Type of Teacher is used to sign in to the PowerSchool SIS Teacher portal. A user can have access to both portals. In which case, the import file should contain two rows for the user, one with the User Type of Staff and another row with User Type of Teacher.

  1. On the start page within the PowerSchool SIS Admin portal, choose Data and Reporting in the left-hand menu.

  2. Data and Reporting will open, then select Export.

  3. Under Export click Data Export Manager. 

    image-20250116-202801.png

  4. In the Select Columns to Export section:

    1. Choose PowerSchool Data Sets as the Category.

    2. Choose one of the following from Export From. **Note - You will need to run this multiple times if you need to export all users.**

      1. SSO Staff Mapping

      2. SSO Teacher Mapping

      3. SSO Parent Mapping

      4. SSO Student Mapping

  5. Select the columns to export:

    1. For Staff and Teacher, User DCID, SSO User Type, Global Identifier are required.

    2. For Parent, Person ID, SSO User Type, Global Identifier are required.

    3. For Student, Student DCID, SSO User Type, Global Identifier are required.

    4. Click Next.

      image-20250116-203815.png

  6. In the Select/Edit Records section, you can use the Built In Filters to narrow the list of records to export, then click Next.

  7. In the Export Summary and Output Options section:

    1. Change the Export File Name extension from .txt to .csv.

    2. Choose Comma as the Field Delimiter.

    3. Choose UTF-8 as the Character Set.

      image-20250116-204032.png

  8. Click Export.

Part B: Merge Export with Google Data

Optional: Export users from Google Admin Console to use with the PowerSchool Export

Part C: Import Merdged Data to PowerSchool

Import File

  1. In PowerSchool SIS for Administrators, navigate to the Data Import Manager page.

  2. Select the source and target:

    1. Choose the file you want to import.

    2. Choose SSO User Mapping as the Import Into.

    3. Choose Comma as the Field Delimiter.

    4. Choose Unicode as the Character Set.

  3. Click Next.

  4. Click Next.

  5. Click Import.

Verify Imported Merged Files

Once the PowerSchool SIS user export files and the identity provider user export file are merged into one file and imported back into the PowerSchool SIS, you will want to verify that your identity provider's global identifier appears in the PowerSchool SIS. Re-run the exports to ensure that Global ID column data appears as expected.

Step 6: Test SSO for Personas

After mapping the users from the identity provider to the PowerSchool SIS, test the SSO connection between your identity provider and the PowerSchool SIS as the service provider. To test a persona, enable OIDC authentication and then verify that you can sign in to the respective portal. Be sure to test each persona in another browser or using an incognito window before ending your current session.

Enabling OIDC authentication for users without also defining Global Identifiers for users will prevent users from being able to sign in.

  1. In PowerSchool SIS for Administrators, navigate to the OIDC Authentication page.

  2. Select Enable OIDC Authentication for the persona you want to test. It is recommended that you first test teachers, then parents, then students, and finally staff.

  3. Click OK.

  4. Click Submit, but do not close the window.

  5. Based on your Step 3 selection, choose the user you want to test.

  6. Open a new private browser window.

  7. Based on your Step 3 selection, enter the URL of your district's PowerSchool SIS Teacher, Student and Parent, or Admin portal and press ENTER or RETURN. The PowerSchool SIS portal should redirect to the IdP's sign-in page.

  8. Sign in with the user's credentials. For teacher, parent, and student, if the PowerSchool SIS portal launches, the setup has been configured properly. For staff, if the PowerSchool SIS Admin portal launches and you are expelled from your first session, as you are only allowed one session at a time, the setup has been configured properly.

  9. For parent, and student, open the PowerSchool Mobile app. Sign in with the user's credentials.

Step 7: Enable OIDC Authentication

The final step of setting up the PowerSchool SIS as OIDC Service Provider is to enable OIDC authentication.

  1. In PowerSchool SIS for Administrators, navigate to the OIDC Authentication page.

  2. Select Enable OIDC Authentication for the user you want to enable.

  3. Click OK.

  4. Click Submit.

  • No labels