Implementation Details

How the Integration Works

Edlink's OAuth2 integration allows schools and organizations to connect an external OAuth2-compliant authentication provider to enable secure access to connected platforms. This integration facilitates authentication and authorization but does not sync roster data.

Integration Workflow

1. OAuth2 Provider Setup: Schools or organizations configure an OAuth2 provider (e.g., Google, Okta, Microsoft Entra ID, or AWS Cognito) to handle authentication.
2. Edlink Connection: The OAuth2 provider is connected to Edlink as an authentication source.
3. Enrichment: The OAuth2 source is linked to the primary rostering source (e.g., SIS, LMS, or CSV upload) to enable login for integrations associated with that source.

Recommendations for Successful Implementation

• Ensure Matching Identifiers: Verify that email addresses or usernames in the OAuth 2.0 provider match those in the primary data source to avoid authentication issues. Mismatched identifiers will prevent successful authentication.
• Choose a Reliable Provider: Select an OAuth 2.0 provider that adheres to the OAuth 2.0 standard and meets the security requirements of your organization.
• Secondary Source Requirement: OAuth2 is always used as a secondary source in Edlink integrations and cannot replace a primary rostering source.
• Coordinate Sources: Confirm that your primary source is providing accurate and up-to-date roster data since OAuth 2.0 will only handle authentication.
• Testing & Validation: Ensure email addresses or usernames match between the OAuth2 provider and the primary rostering source before launching. Mismatched data will result in failed authentication.
• Security Best Practices: Choose an OAuth2 provider that aligns with your organization's security policies. Providers offering multi-factor authentication (MFA) are recommended for enhanced security.
• Scope Configuration: Configure the provider to request the appropriate OAuth2 scopes, such as:
  • openid for user profile access.
  • email to retrieve the user's email address.
  • profile for additional user data.
  • offline_access for refresh token support.

Supported OAuth2 Providers

• Any OAuth2-compliant provider can be used, including:
  • Google
  • Okta
  • Microsoft Entra ID
  • AWS Cognito
  • Custom OAuth2 providers