Important to know
LinkedIn began support of a new SSO certificate on March 25, 2020. This updated certificate is valid for 10 years.
If you didn’t renew your previous certificate before March 25, 2020, please follow the instructions below based on your IdP (identity provider) to restore access:
In order to restore access for your users, please perform one of the following options:
Option 1:
Download the new certificate and add to the existing signature certificates list in Identity Provider (IDP).
To add a certificate in ADFS:
-
Download the new certificate and add it to the existing signature certificates list in ADFS. (See also Related Tasks section below.)
-
In ADFS, locate Relying Party Trust for LinkedIn Learning and open properties to edit.
-
Click the Signature tab.
-
Click Add.
-
Upload the new certificate and click OK.
OR
Option 2:
Turn off the option to sign authentication requests in the SSO settings for Learning and make the corresponding change in your IDP.
To turn off sign authentication requests, please navigate to the settings for Learning and follow the steps below:
-
Navigate to your ADFS and update the SignedRequestRequired setting to False. View documentation here.
-
From Learning Management, select Me > Authenticate.
-
Locate the SAML connection you would like to update and click the More icon
, then select Edit. Note: Make sure your SSO connection is set to Active before editing your settings.
-
In the pop-up window, select SSO settings, then select No for Sign AuthnRequest.
-
Click Save.
Here's a tip
A workaround is available if you’re not able to immediately update your certificate. This should only be used as a temporary solution as you work to update your certificate.
Important: IDPs Azure AD, Okta, and OneLogin ignore the SSO certificate as long as your organization hasn't built any custom functionality to sign authentication requests.
If your organization hasn’t built any custom functionality, no action is needed.
If your organization has built any custom functionality that requires a signed authentication request, please do one of the following options:
Option 1:
Download the new certificate and add to the existing signature certificates list in Identity Provider (IDP).
OR
Option 2:
Turn off the option to sign authentication requests in the SSO settings for Learning and make the corresponding change in your IDP.
To turn off sign authentication requests:
-
From Learning Management, select Me > Authenticate.
-
Locate the SAML connection you would like to update and click the More icon
, then select Edit. Note: Make sure your SSO connection is set to Active before editing your settings.
-
Scroll down to the SSO Options section, and select No for Sign AuthnRequest.
-
Click Save.
In order to restore access for your users:
-
Download the new certificate and add to the existing signature certificates list in Identity Provider (IDP).
-
In Cornerstone, navigate to Admin then Tools.
-
Click Edge then Integrations.
-
Locate the LinkedIn Learning integration and open to edit.
-
Scroll down to Service Provider.
-
Open the downloaded certificate in a text editor and copy the text in between the comments. Do not include “-----BEGIN CERTIFICATE-----” or “-----END CERTIFICATE-----.”
-
Paste the certificate you copied into the SP X.509 Certificate field.
-
Save settings.
In order to restore access for your users:
-
Download the new certificate and add to the existing signature certificates list in Identity Provider (IDP).
-
Log in to PING Federate admin console.
-
Select IDP provider and SP Connection.
-
Click Manage all and enter LinkedIn in search window.
-
Open the LinkedIn Learning connection.
-
In the bottom of the connection, click Signature Verification Certificate.
-
Click Manage Certificate.
-
Click Import to add new LinkedIn Learning certificate.
-
Save and test SP-Initiated SSO attempt.
Verify it’s working. If it's not, reach out to your account rep(s).
You can send a SAML assertion to LinkedIn Learning by invoking an IdP-Initiated request. With an IdP initiated attempt, you’ll be able to access Account Center to download the new metadata.
You can also download the new certificate and replace the expired x509 certificate in LinkedIn Learning’s metadata with the new x509 certificate (if you have saved the metadata or can download it from your Shibboleth setup). If you need assistance with this, please reach out to your Account Representative.
SuccessFactors does not use our signing certificate, so no action is required. To disable AuthnRequest signing in LIL, expand the SSO connection and select No under "Sign AuthnRequest."
In order to restore access for your users, please do one of the following options:
Option 1:
Download the new certificate and add to the existing signature certificates list in Identity Provider (IDP).
OR
Option 2:
Turn off the option to sign authentication requests in the SSO settings for Learning and make the corresponding change in your IDP.
To turn off sign authentication requests:
-
From Learning Management, select Me > Authenticate.
-
Locate the SAML connection you would like to update and click the More icon
, then select Edit. Note: Make sure your SSO connection is set to Active before editing your settings.
-
In the pop-up window, select SSO settings, then select No for Sign AuthnRequest.
-
Click Save.
If you need further assistance, please contact your account team or your customer success manager. You can also email your rep to confirm that you’ve either taken action to update your certificate, or that you don't use signed authentication requests and aren't impacted by this change.
FAQs
A SSO certificate stands for Single Sign-on certificate. It is a certificate that validates our system’s initiated authentication requests.
When setting up your organization’s SSO (Single Sign-on) integration with our products, a CA-signed certificate was downloaded through the process. Although many customers aren't affected by the expiry of this certificate, the following customers are affected:
-
Customers using ADFS where ADFS is configured with SP certificate signing turned on.
-
Customers using self-built/smaller IDPs or other major IDPs with custom functionality added that turns on SP certificate signing.
We began supporting the new certificate on March 25, 2020 at Noon GMT (8:00 am ET / 5:00 am PT). Not updating the certificate prior to this time may have caused a failure to access LinkedIn Learning for your learners. The new certificate has a ten-year validity.
Please work with your IT team to confirm that your certificate and SSO settings are correct to ensure all employees can continue to log into LinkedIn Learning.
We don't have the ability to renew the certificate on your behalf. Please work with your IT team to confirm that your certificate and SSO settings are correct to ensure all employees can continue to log into LinkedIn Learning.
We understand how frustrating it must be for members of your organization to receive automated weekly reminders. We sincerely apologize for the inconvenience this may have caused. To be extra sure, we decided to send automated weekly reminders so none of our customers are left without access on March 25th, 2020.
Related task: