Set up Single Sign-On for your school or MAT (Google)

This article describes the configuration steps required to connect your Carousel Platinum account to your Google for Education account, to take advantage of Single Sign-On within your organisation.

Single Sign-On is available for Platinum subscriptions with MIS integration.

Before you start

• In order to configure Single Sign-On with Google for your organisation, you will need to have the "Super Admin" role in your Google account, and/or be able to edit the "API Controls" area of your organisation's Google Admin account. If you do not have these permissions, please forward these instructions to an administrator with suitable permissions so that they can continue.
• In order for teachers to use Single Sign-On the email address in the Google Directory and the school's MIS must match.  The MIS email will sync to Carousel and allow verification of the Google credentials.
• If you want to enable SSO for students (as well as teachers), you first need to enable the student email scope via Wonde. To do this, you or someone with Admin permissions for the school's Wonde portal will need to head to the 'Permissions' section, then toggle on the optional 'Student > Students contact details read > Students email read' permission.
• For SSO to work for students, you must store student emails in your MIS against each student, and these emails must match the ones they use for SSO.

Configuration

1. Access the "Configured Apps" area of the API Controls section of your Google Admin account via this link.

2. If you are already logged in to your Google Super Admin account, you can skip to step 3. If you are not yet logged in, sign in as instructed.

3. Once logged in, you will see an "Add app" dropdown similar to the following. Click the dropdown and select "OAuth App Name or Client ID" from the list.

4. In the box provided, enter "Carousel Learning" as the app name and then click SEARCH and select the Carousel app:

You may also be prompted to select OAuth Client IDs. If this option appears for you, click the available checkbox and click SELECT:

5. Next you'll see a "Scope" screen. Select the scope of which org units the SSO integration should apply to and click CONTINUE. You may have the option to authorise for part or all of your organisation.

6. Finally select what "Access to Google Data" status you wish the app to have and click CONTINUE. We recommend using the "Trusted" option.

7. Select "Allowlist for exemption from API access blocks in context-aware access. Available only for apps added via OAuth client IDs."

Click CONTINUE and FINISH.

You should now see the Carousel Learning app showing in your "Configured Apps" list in the Security > API Controls > App Access Control menu:

8. To complete SSO setup for your MAT or School, contact our helpdesk  at [e-mail] and request Google SSO activation. Please only do this after completing the steps above and ensuring the optional Wonde scopes 'Student Contact details read' and 'Student email addresses read' have been approved in the Winde portal. Once SSO is enabled, your School/MAT's users will only be able to log on with SSO.

Note: When SSO is activated you can still login to Quizzes and Study Packs assigned to the Carousel Demo class using the Demo student's first name/last name.

If your school uses Microsoft SSO for either staff or students, please follow the preparatory steps in this article.

Please contact our helpdesk at [e-mail] if you need any further advice with setting up Single Sign-On.