Set up KnowledgeOwl's ClassLink app

KnowledgeOwl has its own app in ClassLink's app library. If your readers' school districts use it, you don't have to register anything with ClassLink: you add each district to your knowledge base, and the district's ClassLink Tenant Administrator approves it. One knowledge base can work with many districts.

If your district created its own OpenID Connect app in ClassLink instead, refer to Configure ClassLink SSO with your district's own app. For a general introduction to OpenID Connect, refer to OpenID Connect (OIDC) SSO overview.

Before you begin

You'll need:

• The ClassLink tenant ID of each district. Tenant IDs are numbers, such as 2187. Ask each district's ClassLink administrator for theirs.
• Someone in each district who is a ClassLink Tenant Administrator. They approve your knowledge base for their district.
• The Editor role in KnowledgeOwl, or a custom role with the Update security settings permission.

How to set up KnowledgeOwl's ClassLink app

The setup has five steps on the OpenID Connect (OIDC) page. The steps don't block each other, so you can come back to any of them.

Step 1: Choose ClassLink

1. Go to Security and access > Access & SSO.
2. In the Login methods card, select Set up (or Manage) next to OpenID Connect (OIDC).
3. In Choose your identity provider, select ClassLink. It starts on KnowledgeOwl's app, and the step summary shows ClassLink · KnowledgeOwl's app.

If you picked your district's own app earlier, select Switch to KnowledgeOwl's app. Your own app's settings are kept, so you can switch back later.

Step 2: Add KnowledgeOwl to your districts

First, each district adds the KnowledgeOwl app from ClassLink's app library and assigns it to the people who should read your knowledge base. The step links to the app in the library so you can share it.

Then add the districts to your knowledge base:

1. In the Add KnowledgeOwl to your districts step, select Add districts.
2. In ClassLink tenant IDs, enter one or more tenant IDs. Separate several with commas or new lines.
   Enter one or more ClassLink tenant IDs
3. Select Add districts. Each new district shows Waiting for approval.

Adding a district saves right away. A knowledge base can have up to 500 districts.

Get each district approved

Readers from a district can log in once one of its ClassLink Tenant Administrators approves your knowledge base. To ask them:

1. Open the ... menu next to a waiting district and select Copy approval instructions. Right after you add districts, or when you select the Waiting filter (shown with six or more districts), you can also use Copy approval instructions above the list.
2. Send the instructions to the district's Tenant Administrator. They tell them to log in to ClassLink, open the KnowledgeOwl app, and choose Approve next to your knowledge base.

For what the Tenant Administrator sees, refer to Approve a knowledge base in ClassLink (for Tenant Administrators). You can send them that article too.

District statuses

Each district shows its name (or its tenant ID until it's approved), the date of its last change, and one of these statuses:

Districts and their approval status

With six or more districts, use the search box (Search by name or tenant ID) and the filters All, Active, Inactive, Waiting, Declined, and Expired.

Manage a district

Open the ... menu next to a district. Each action saves right away.

• Make inactive: stop the district's readers logging in, but keep it listed. You can't make your last active district inactive while OpenID Connect is on: turn OpenID Connect off first.
• Make active: let an inactive district's readers log in again.
• Copy approval instructions: for a district that's waiting.
• Ask again: send a new request to a district that declined or expired.
• Remove: take the district off your list. Its readers can't log in, and adding it again later needs a new approval. To keep it listed, make it inactive instead.

Step 3: Restrict who can log in

Only readers from your active districts can log in, so you don't need a restriction. To narrow it further:

1. In the Restrict who can log in step, select Add restriction.
2. Enter a Claim, like classLink_role, and its Allowed values, like Teacher.
3. Select Save changes in the bar at the bottom of the page.

Readers must match every restriction. Within a row, separate allowed values with commas: a reader who matches any one of them passes.

Step 4: Map reader attributes

The Map reader attributes step is filled in for ClassLink:

• SSO ID is locked to {classLink_tenant_id}:{classLink_sourcedId}, so each ClassLink user is matched to a single reader across all your districts.
• Username / email, First name, and Last name come from email, given_name, and family_name.
• Reader groups comes from classLink_role. Group names must match your reader groups exactly, so create groups named after the roles you want to use, change the claim, or remove the field.

To assign groups conditionally, use Set reader fields with rules. Select Save changes after any change.

Step 5: Turn on OpenID Connect

You need at least one approved, active district before you can turn it on.

1. Open the Turn on OpenID Connect step.
2. Choose one:
   • Available: Readers can log in with the login link or from ClassLink. Restricted content on a public knowledge base can send them here too.
   • Required for all readers: Anyone who isn't logged in is sent straight to ClassLink.
3. Select Save changes.

Once it's on, the step shows your Login link. Select Copy to share it.

How readers log in

There's no ClassLink button on the reader login page. Readers reach ClassLink in any of these ways:

• From the KnowledgeOwl tile on their ClassLink LaunchPad.
• With the Login link from Step 5, which you can add to your website, emails, or LMS.
• With the Log in link in your knowledge base header, when it goes to OpenID Connect.
• By being sent to ClassLink automatically when OpenID Connect is Required for all readers, or when Send readers who aren't logged in to on the overview is set to OpenID Connect login.

If a district uses more than one of your knowledge bases, readers who open the tile see Choose a knowledge base and pick the one to open.

Check recent logins

Below the steps, open Recent logins to see what ClassLink sent for readers' logins, district approvals, and test logins from the past 14 days. Use the filters All, Logged in, Failed, Test logins, and District approvals, and select Show claims to see a login's details. You can also select Run a test login to log in as yourself without logging in to the knowledge base.

Readers whose login fails see your knowledge base's no-access page, and the reason shows in Recent logins. For help with failure messages, refer to Troubleshoot OpenID Connect logins.

Messages people might see from the ClassLink tile