Skip to main content

Integrate with Absorb LMS

authentik: 2026.5.0+Support level: Community

What is Absorb LMS?​

Absorb LMS is a cloud-based learning management system used by organizations to deliver, track, and manage employee, partner, and customer training. It lets you create or import courses, assign them to different audiences, and report on learner progress and compliance from a centralized portal.

-- https://www.absorblms.com/

Preparation​

The following placeholders are used in this guide:

  • company.myabsorb.com is the FQDN of the Absorb LMS deployment.
  • authentik.company is the FQDN of the authentik installation.
info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

Absorb LMS can use either OIDC or SAML for SSO. Choose one protocol for authentication. You can also configure SCIM provisioning after you create the authentik application.

Absorb LMS access requirements

To configure SSO in Absorb LMS, you need an Absorb LMS system administrator account. Absorb LMS account provisioning and SCIM availability depend on your Absorb LMS plan and enabled features.

authentik configuration​

To support the integration of Absorb LMS with authentik, create one application/provider pair in authentik using either OIDC or SAML.

Redirect URI changes in authentik 2026.5

In authentik versions earlier than 2026.5, all Redirect URIs are automatically treated as Authorization type. If you are using one of these older authentik versions, add only the Authorization URL to your Redirect URIs and do not configure a Post Logout URI.

Create an application and provider​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Applications and click New Application to open the application wizard.
    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application Slug because it is used later as <application_slug>.
    • Choose a Provider type: select OAuth2/OIDC Provider as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Note the Client ID and Client Secret values.
      • Add a Redirect URI with the type Strict and Authorization, using the value https://company.myabsorb.com/api/rest/v2/authentication/openIdConnect.
      • Select an available Signing Key.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page. If you add a SCIM provider as a backchannel provider later, only users who can view this application are synchronized.
  3. Click Create Application to save the new application and provider.

Configure Absorb LMS SSO​

  1. Log in to the Absorb LMS Admin Experience as a system administrator.
  2. Click the account icon in the top right, navigate to Client Settings, and open the SSO configuration card.
  3. Click Add SSO Configuration and set the following values:
    • Name: authentik
    • Method: OpenID Connect
  4. Continue to the configuration step and set the following values:
    • OpenID Connect authentication protocol method: Client Secret Basic
    • JWT signature type used for the authentication: RS256
    • Use Dynamic Keys: enabled
    • Discovery URL: https://authentik.company/application/o/<application_slug>/.well-known/openid-configuration
    • Client Identifier from the Authorization Server: the Client ID from authentik.
    • Client Secret from the Authorization Server: the Client Secret from authentik.
    • Issuer URL: https://authentik.company/application/o/<application_slug>/
    • Authorization Endpoint URL: https://authentik.company/application/o/authorize/
    • Token Endpoint URL: https://authentik.company/application/o/token/
    • ID Property: Email Address
    • Logout URL (optional): https://authentik.company/application/o/<application_slug>/end-session/
  5. Continue to the access step and select the Assigned Routes that should use this SSO configuration.
  6. Enable Automatically Redirect if users should be sent directly to authentik when they open an assigned route.
  7. Click Save.

Absorb LMS configuration​

Configure SCIM provisioning (optional)​

Configure SCIM provisioning after you configure OIDC or SAML. If you add the SCIM provider as a backchannel provider, only users who can view the Absorb LMS application are synchronized.

SCIM OAuth authentication

The OAuth (Interactive) authentication mode for SCIM providers requires an authentik Enterprise license.

Enable SCIM in Absorb LMS​

  1. Log in to the Absorb LMS Admin Experience as a system administrator.
  2. Click the account icon in the top right, navigate to Client Settings, and open the SSO configuration card.
  3. Under SCIM Settings, click Manage.
  4. Note the SCIM OAuth Client ID and SCIM OAuth Client Secret values.
  5. Select a Default Department for provisioned users.
  6. Click Save.

Create an OAuth source​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Directory > Federation and Social login and click New Source.
  3. Select OpenID OAuth Source as the source type and click Next.
  4. Set the following values:
    • Source Name: provide a descriptive name.
    • Slug: provide a slug or use the automatically generated slug.
    • Consumer key: the SCIM OAuth Client ID from Absorb LMS.
    • Consumer secret: the SCIM OAuth Client Secret from Absorb LMS.
    • Scopes: offline_access
    • Under URL settings:
      • Authorization URL: https://company.myabsorb.com/scim/v2/oauth/authorize
      • Access Token URL: https://company.myabsorb.com/scim/v2/oauth/token
      • Authorization code authentication method: Include the client ID and secret as request parameters
  5. Click Create.

Create a SCIM property mapping​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Customization > Property Mappings and click New Property Mapping.

  3. Select SCIM Provider Mapping as the property mapping type and click Next.

  4. Set the following values:

    • Mapping Name: Absorb LMS SCIM user

    • Expression:

      given_name, family_name = request.user.name, " "
      formatted = request.user.name + " "
      if " " in request.user.name:
          given_name, _, family_name = request.user.name.partition(" ")
          formatted = request.user.name

      emails = []
      if request.user.email:
          emails = [{
              "value": request.user.email,
              "type": "work",
              "primary": True,
          }]

      phone_number = request.user.attributes.get("phone")
      phone_numbers = []
      if phone_number:
          phone_numbers = [{
              "value": phone_number,
              "type": "work",
              "primary": True,
          }]

      return {
          "userName": request.user.username,
          "name": {
              "formatted": formatted,
              "givenName": given_name,
              "familyName": family_name,
          },
          "active": request.user.is_active,
          "emails": emails,
          "phoneNumbers": phone_numbers,
      }

  5. Click Create.

Create a SCIM provider​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Providers and click New Provider to open the provider wizard.
    • Choose a Provider type: select SCIM Provider as the provider type.
    • Configure the Provider: provide a name for the provider and configure the following settings.
      • URL: https://company.myabsorb.com/scim/v2
      • Authentication Mode: OAuth (Interactive)
      • OAuth Source: select the OAuth source that you created.
      • Group Filter: select the group that contains users that should be provisioned to Absorb LMS.
      • Under Attribute mapping, remove authentik default SCIM Mapping: User from Selected User Property Mappings and add Absorb LMS SCIM user.
  3. Click Create.
  4. Open the SCIM provider.
  5. On the Overview tab, click (Re-)authenticate.
  6. You should be redirected to Absorb LMS for authentication. Log in as an Absorb LMS administrator and approve the connection.
  7. Return to the SCIM provider and confirm that OAuth Status shows Authenticated.

Add the SCIM provider to the application​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Applications and click the Absorb LMS application that you created.
  3. Click the plus (+) icon next to Backchannel Providers and select the SCIM provider that you created.
  4. Click Save Changes.

Configuration verification​

To confirm that authentik is properly configured with Absorb LMS, log out and open Absorb LMS. If you configured automatic redirect, Absorb LMS redirects you to authentik. Otherwise, start the SSO login flow from Absorb LMS, sign in with authentik, and confirm that you return to Absorb LMS.

If you configured SCIM, open the Absorb LMS SCIM provider in authentik and click the run button on the Full sync for SCIM provider task. After the sync completes, verify that users with access to the Absorb LMS application are provisioned in Absorb LMS.

Resources​