Clarification on Sunbird SSO/Federation Support

[suraj-tekdi]

Hi team,
We are currently working on the NULP (Sunbird-based platform) integration with the iGOT Karmayogi platform for course consumption and learner synchronization. As part of this integration, the NULP team is evaluating the best possible approach for implementing Single Sign-On (SSO) between the two platforms.

During our analysis, we observed that the Sunbird Keycloak setup is using a Cassandra-based user federation provider instead of the default Keycloak user store. We wanted to understand whether Sunbird officially supports federation-based SSO integrations such as:

• SAML federation
• OIDC/OpenID Connect federation
• Keycloak identity brokering
• External platform authentication integration

Specifically, we would like guidance on the following points:

• Is SAML federation-based SSO officially supported in Sunbird?
• Can Sunbird Keycloak act as an Identity Provider or Service Provider for external platform integrations?
• Does the Cassandra user federation setup impact or restrict SSO federation capabilities in any way?
• What is the recommended and feasible approach for integrating Sunbird/NULP with external platforms like iGOT Karmayogi?
• Is OIDC-based identity brokering preferred over SAML in the current Sunbird architecture?
• Are there any existing reference implementations or recommended architectural patterns for such integrations?

Our current use case is:

• Users from the iGOT Karmayogi platform should be able to access and consume NULP courses seamlessly.
• Progress tracking and certificate synchronization may also need to be integrated between the platforms.
• We are evaluating whether redirect-based SSO or federation-based authentication would be the best supported solution within the Sunbird ecosystem.

It would be very helpful if you could provide clarity on the officially supported integration approaches and any technical recommendations from the Sunbird perspective.

[JeraldJF]

@suraj-tekdi Ok, we are looking into it and provide you with an update as soon as possible.

[JeraldJF]

@suraj-tekdi Could we connect tomorrow from 2:30 PM to 3:00 PM IST to go over through the requirements/clarification?

[suraj-tekdi]

@JeraldJF Can we connect in the first half. at 12:30 to 1:00 PM?

[JeraldJF]

@suraj-tekdi Ok, we can connect. Please share the meeting details and include sntiwari@sanketika.in, chethang@sanketika.in into the meeting.

[suraj-tekdi]

Can you share the code for OIDC based sso implementation here?

[chethann007]

Hey @suraj-tekdi , we recommend OIDC-based federation for NULP + iGOT Karmayogi integration as that's what we've successfully implemented with Google in our latest Sunbird release.

Reference implementation: https://github.com/Sunbird-Spark/sunbird-spark-portal/tree/main/backend/
Just for reference - Along with usecase statement with respect to SSO: https://github.com/sunbird-lern/lern-service/tree/main

Review the implementation and configure your Keycloak realm accordingly.