Single Sign-on

Setting up Single Sign-on in BetterExaminations

BetterExaminations supports Single Sign-On (SSO) integration, allowing your users to authenticate using your organisation's existing identity provider (IdP). This eliminates the need for separate login credentials and provides a seamless authentication experience for exam candidates and administrators.

How SSO works with BetterExaminations

When SSO is enabled, users accessing BetterExaminations Online are redirected to your organisation's login page. Once authenticated through your IdP, they are seamlessly signed into BetterExaminations without needing a separate password. This is commonly called "federated authentication".

BetterExaminations currently supports the following SSO protocols:

If you are unsure which protocol your IdP supports, contact us and we will advise on the best approach for your setup.

General Integration Process

Regardless of which identity provider or protocol you use, the integration follows the same high-level process:

1. Create an application - Register BetterExaminations as a new application/integration in your IdP.
2. Configure endpoints - Enter the BetterExaminations service URLs (Entity ID, callback URL, etc.) provided to you during onboarding.
3. Map user attributes - Configure which user fields (email, name, etc.) are sent to BetterExaminations in the authentication response.
4. Export metadata/credentials - Download your IdP's metadata file or provide the relevant configuration details (issuer URL, certificate, client ID/secret for OIDC).
5. Assign users - Grant the appropriate users or groups access to the BetterExaminations application in your IdP.
6. Send configuration to BetterExaminations - Provide us with the metadata/credentials so we can complete the integration on our side.
7. Test & validate - Verify end-to-end login works correctly.

Recommendation

We strongly recommend providing a temporary test user during setup. This allows our team to validate the integration end-to-end without disrupting your production users. The test user can be removed once setup is confirmed working.

Integration Example: Microsoft Entra ID with SAML 2.0

The following is a step-by-step walkthrough of setting up SSO with Microsoft Entra ID (formerly Azure AD) using the SAML protocol. If you use a different IdP, the concepts are the same - only the specific interface will differ.

Create a new Enterprise Application

1. Sign in to the Microsoft Azure Portal (portal.azure.com).
2. Navigate to Enterprise Applications → All applications.
3. Click New application.
4. In the Microsoft Entra Gallery, click Create your own application.
5. Enter a name for the integration (e.g. BetterExaminations).
6. Click Create.

Select SAML as the sign-on method

1. In the application overview, click Set up single sign on.
2. Select SAML as the single sign-on method.

Configure Basic SAML settings

On the "Set up Single Sign-On with SAML" page, edit the Basic SAML Configuration section with the values provided by BetterExaminations:

Configure Attributes & Claims

Verify the following SAML attribute mappings in the Attributes & Claimssection:

Download the Federation Metadata XML

In the SAML Certificates section, download the Federation Metadata XML file. Send this file to your BetterExaminations account contact.

Assign Users and Groups

Navigate to Users and groups in the application menu and add the users or groups that should have access to BetterExaminations Online via SSO.

Once you have sent the Federation Metadata XML file (and optionally, test user credentials) to BetterExaminations, our team will complete the configuration and notify you when SSO is ready for testing.