Product: LaunchPad
Audience: ClassLink Administrator
The following steps will allow you to choose which organizational units the Google IDP settings will affect. You will also set up Chromebook best practices for ClassLink access.
Note: ClassLink recommends that you complete the following settings using a test organizational unit (OU). Please add at least one device and one user in the test OU.
Note: Before completing the steps below, please make sure you have already followed the process to add ClassLink as a third-party SSO provider in the Google Admin Console.
Note: If your G Suite domain is using a G Suite SAML filter app such as ZScaler, whitelist the following domains: *.classlink.com, *.classlink.net, *.classlink.io
1. Log in to the G Suite Admin Console at https://admin.google.com.
2. Click Devices.
3. Under Device Settings -> click Chrome management.
4. Click User & browser settings.
5. From the Organizational Unit section in the left frame -> click the Suborganization for which you wish to apply the changes (by default, the changes made in this section apply to your entire G Suite organization).
6. In the Search or add a filter field, type single.
7. Set Single Sign-On Online Login Frequency to Every 3 Days.
8. Set Single Sign-On to Enable SAML-based Single Sign-On from Chrome Devices.
9. Set the startup page: Search for startup -> locate Pages to load on startup -> add https://launchpad.classlink.com/CUSTOMURL (this is your custom LaunchPad login page URL. Paste the same URL under the Homepage URL. With ClassLink as the IDP, upon authentication on the device level, going to this URL will bring you directly into the LaunchPad My Apps screen.
10. Navigate to the OU where your devices are located and select Device Settings.
11. If applicable, click the sub-organization for which you previously modified the user settings.
12. In the search field -> type Single.
13. For Single Sign-On IdP Redirection -> select Allow users to go directly to SAML SSO IdP page.
Note: If your G Suite domain is using a G Suite SAML filter app such as ZScaler, whitelist the following domains: *.classlink.com, *.classlink.net, *.classlink.io
14. For Single Sign-On Cookie Behavior -> select Enable transfer of SAML SSO Cookies into user session during login.
15. For Single Sign-On Camera Permissions -> enter the following URLs:
Note: Please be sure to enable QuickCard and/or Face from your ClassLink Management Console to display the button on your login page.
16. User Data -> select Erase all local user data to prevent sessions from being saved
Note: ClassLink recommends that you set the Chromebook Action to log out when the Chromebook lid is closed. This will stop the Google account-picker from appearing when the Chromebook locks or goes to sleep.
Updated: Aug 2020