Skip to main content

Set Up Single Sign-On (SSO) with Blackbaud ID

This guide walks administrators through configuring Single Sign-On (SSO) between Orah and Blackbaud ID, allowing staff and users to log in to Orah using their Blackbaud credentials.

Updated over a week ago

🧩 Overview

Single Sign-On (SSO) with Blackbaud ID enables users to access Orah without needing a separate password. Once configured, users authenticated in Blackbaud can securely log in to Orah via Blackbaud’s identity provider.

Why this matters:

  • Simplifies login experience for staff and administrators

  • Improves security through centralized authentication

  • Reduces password reset and access issues

Applies to:

  • ✅ Admins

  • ✅ IT / System Administrators

  • ✅ Schools using Blackbaud as their SIS / Identity Provider

🧭 Step-by-Step Instructions

Step 1: Create an SSO Profile in Orah

  1. Log in to Orah as an administrator

  2. Navigate to Admin Console → Authentication

  3. Click Create New Profile (top right)

  4. Select Blackbaud ID as the profile type

  5. Choose which users can log in using this SSO profile

  6. Copy the Redirect URL generated by Orah

  7. Keep this page open — you’ll return to it later
    ​

Step 2: Configure SSO Settings in Blackbaud

  1. Log in to Blackbaud as a Platform Manager

  2. Go to Core → Security → Authentication Settings → SSO Settings

  3. Click Add New

  4. Enter a Name (e.g., “Orah”)

    • The Slug will auto-generate

  5. Paste the Redirect URL copied from Orah into the Redirect URL field

  6. Click Save
    ​

Step 3: Capture Login URL & Secret Key

  1. Locate the newly created SSO profile

  2. Copy the URL Path (example: /app/sso/auth/orah)

  3. Combine it with your school’s base URL

  4. Save this Login URL temporarily

  5. Click Edit on the SSO profile

  6. Copy the Secret Key

    • Ensure you copy the full string

  7. Click Save
    ​

Step 4: Complete the Setup in Orah

  1. Return to the Orah SSO profile created earlier

  2. Paste the saved Login URL into the Login URL field

  3. Paste the Secret Key into the Client Secret field

  4. Click Save
    ​

Step 5: Test the SSO Connection

  1. Click Test Run in the SSO profile
    ​

  2. You’ll be redirected to the Blackbaud login page (if not already logged in)

  3. After authentication, you’ll be redirected back to Orah

  4. A success page confirms the setup is working
    ​

💡 Best Practices / Tips

  • Use a dedicated Platform Manager account when configuring SSO

  • Double-check Redirect URLs — they must match exactly

  • Store the Secret Key securely (treat it like a password)

  • Test with a non-admin user before full rollout

❓ FAQs

Do all users need Blackbaud accounts to use SSO?

Yes. Only users authenticated in Blackbaud can log in via this SSO method.

Can we keep Orah login as a backup?

Yes. Schools can allow both SSO and standard login if needed.

Who can configure this setup?

A Blackbaud Platform Manager and an Orah Admin are both required.

🔧 Troubleshooting

Token validation fails

  • Recopy the Secret Key

  • Ensure no spaces were added when pasting

Redirect URL mismatch

  • Confirm the Redirect URL in Blackbaud exactly matches Orah

Users stuck in login loop

  • Verify Login URL is correct

  • Confirm SSO profile is enabled for that user role

SSO test fails

  • Re-authorize and re-save both sides

  • Confirm Platform Manager permissions

Additional Resources

Veracross OpenID Connect (OIDC) / OAuth Application Setup Guide

Related Articles
Enabling Single Sign-On (SSO)
Multi-School Login on Orah
Setting up Blackbaud Integration
Set Up Single Sign-On (SSO) with Veracross (OpenID Connect)
Did this answer your question?