You can connect an Aiyori workplace training organization to your company’s identity provider. Learners log in with their company account (SSO with OpenID Connect), and joiners, transfers and leavers are reflected automatically (SCIM 2.0).
This page and the guide for each identity provider are written for your IT team and for the administrator of the Aiyori organization (the person who created it). You can check how the connection works before you start.
Guides by identity provider
- Okta: SSO (OpenID Connect) and SCIM.
- Microsoft Entra ID: SSO (OpenID Connect) and SCIM. SCIM requires Entra ID P1 or higher.
- Google Workspace: SSO (OpenID Connect). SCIM isn’t available, so automatic registration and bulk registration from a table are used instead.
Other identity providers that support OpenID Connect can also be connected with the values on this page.
Decide first
- Who gets in. Only the people and groups assigned to the Aiyori app in your identity provider can sign in (not everyone). With SCIM, the groups you assign, such as departments or hiring years, become Aiyori groups as they are.
- How people log in. Company accounts only, or PINs as well. For large companies we recommend company accounts only (people who have left can no longer get in with a PIN).
- How the roster gets in. Automatically with SCIM (Okta, Microsoft Entra ID), by registering people automatically the first time they log in with a company account, or by bulk registration from a table (CSV) every month. Google Workspace has no SCIM, so it uses the last two.
Aiyori values for your identity provider
The redirect URI and the SCIM base URL are also shown on the trainer’s screen under “Settings” → “Connect your company’s identity provider”, with copy buttons. Only the organization’s administrator (the person who created it) can change these settings.
- Redirect URI
- https://app.aiyori.app/
api/ web/ sso/ callback
Register it in the Aiyori app in your identity provider. Login fails if even one character is different. - SCIM base URL
- https://app.aiyori.app/
api/ scim/ v2
Enter it as the SCIM connector base URL in Okta, or as the Tenant URL in Entra ID. - SCIM key
- Create it with “Create key” in “Connect your company’s identity provider”. It’s shown only once, when you create it (up to 5 per organization). Enter it as the Bearer token in Okta, or as the Secret Token in Entra ID.
- Login entry point (for a tile in your company portal)
- https://app.aiyori.app/
api/ web/ sso/ start?code=(organization code)
Enter it as the Initiate login URI in Okta, or as the Home page URL in Entra ID. A tile in your company portal then goes straight to your company login, without entering the organization code.
Values to enter in Aiyori
Enter them under “SSO” in “Connect your company’s identity provider”, then press “Save”.
- Issuer URL
- It depends on the identity provider: https://(your-org).okta.com for Okta, https://login.microsoftonline.com/
(tenant ID)/v2.0 for Microsoft Entra ID, and https://accounts.google.com for Google Workspace. - Client ID
- The ID of the app in your identity provider.
- Client secret
- The secret of the app in your identity provider. It’s stored encrypted and isn’t shown on screen after saving.
- Allowed email domains
- Your company’s email domains (e.g. example.com), one per line. Always enter them. Without them, anyone your identity provider lets through can get in (for Google Workspace, you can’t save without them).
- Automatic registration
- When you don’t use SCIM (for example with Google Workspace), turn on “When someone who isn’t registered yet logs in, register them as a learner”. Only people whose domain matches are registered.
- Turn off PIN login and allow company accounts only
- Turn this on after one person has confirmed they can get in with a company account.
When you save, Aiyori reads the issuer’s OpenID configuration (the issuer URL followed by /.well-known/openid-configuration). If it can’t be read, the settings can’t be saved. The issuer must be a public URL that starts with https (internal names and IP addresses can’t be used).
After saving, use “Try with my company account” in “Try logging in yourself” to check that you can log in with the administrator’s company account and come back to Aiyori (you aren’t registered as a learner).
How learners log in
- On the login screen from the training link, they choose “Log in with company account” and enter the organization code → your company’s login screen → back to Aiyori.
- To put a tile in your company portal (Microsoft My Apps, the Okta dashboard), use the login entry point URL above. People go straight in without entering the organization code.
- People are matched in this order: someone already linked through a company account → a learner with the same work email address (for Entra ID, also a learner whose SCIM userName is the same as the UPN). If neither exists, a person is registered only when automatic registration is on and their domain matches.
- If someone can’t get in, the reason is shown on screen (wrong domain, not registered yet, disabled by company settings, or deactivated).
What SCIM does
| In your identity provider | In Aiyori |
|---|---|
| Assigned a person to the app | A learner is created. The ID is the part of the work email address before the @ (-2 is added if it’s taken). The name is the display name, or is built from the given and family names. |
| Changed a name or email address | The learner’s name and work email address change. |
| Assigned a group, added or removed members | An Aiyori group is created, and people join or leave it. |
| Unassigned or disabled someone, or they left | They can no longer log in (suspended). Their training records are kept. They aren’t counted for the usage fee and are logged out on every device. |
| Restored them | They can get in again. |
| Unassigned a group | The group is archived (training records are kept). |
The department and employeeNumber attributes aren’t used over SCIM (use groups instead). To match people by employee number, use bulk registration from a table (CSV).
Whether to deactivate a learner (their records are deleted 30 days later) is decided by a trainer on the learner’s page, not by your identity provider.
If a key leaks, set it to “Revoke” on Aiyori’s screen, then create a new key and enter it in your identity provider again. Only the sync stops; learners can still log in.
Troubleshooting
| What happens | What to check |
|---|---|
| The SSO settings can’t be saved in Aiyori | The reason is shown on screen: a typo in the issuer URL (the trailing /v2.0 or the tenant ID for Entra ID), common or organizations for Entra ID (not allowed), or no allowed domains for Google Workspace (enter them). Also check that the issuer URL followed by /.well-known/openid-configuration opens in a browser. |
| After the company login, it says the account couldn’t be verified | A mistyped client ID or secret, an expired secret (2 years at most for Entra ID), or a redirect URI that differs by even one character. |
| It says no email address was received | The user has no email address in your identity provider. For Entra ID, add email in Token configuration. |
| It says the domain can’t join | Check that your company’s domain is in Aiyori’s allowed domains. Put subdomains on their own lines. Google Workspace also needs the Workspace primary domain. For Entra ID, when the token has no email, the domain of the UPN is checked. |
| It says the account isn’t registered yet | Check that the SCIM assignment is done, or turn on automatic registration. |
| The SCIM connection test returns 401 | A mistyped key, or a revoked one. The key is accepted with or without Bearer in front of it. |
| The SCIM connection test returns 403 (an HTML 403 Forbidden) | It’s being stopped by the protection in front of Aiyori (WAF). Please let us know through the contact page. |
| People don’t come in through SCIM | Check that they are assigned to the app (Entra ID syncs only assigned users and groups by default). Entra ID syncs about every 40 minutes, so send people on demand when you’re in a hurry. |